https://forums.dropbox.com/topic.php?id=120604&replies=5#post-634412

gistfile1.m

// 1. Containing app - Store token url in the group user defaults.
DBAccount *account = [[DBAccountManager sharedManager] handleOpenURL:url];
if (account) {
    NSUserDefaults *groupDefaults = [[NSUserDefaults alloc] initWithSuiteName:@"group.com.example.app"];
    [groupDefaults setObject:url.absoluteString forKey:@"dropbox.token.url"];
    [groupDefaults synchronize];
}

// 2. An Extension - Retrieve the token url from group user defaults, then give it to -[DBAccountManager handleOpenURL:] after setting "nonce".
NSUserDefaults *groupDefaults = [[NSUserDefaults alloc] initWithSuiteName:@"group.com.example.app"];
NSURL *url = [NSURL URLWithString:[groupDefaults objectForKey:@"dropbox.token.url"]];
for (NSString *pair in [url.query componentsSeparatedByString:@"&"]) {
    NSArray *kv = [pair componentsSeparatedByString:@"="];
    if ([kv[0] isEqual:@"state"]) {
        NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
        [defaults setObject:kv[1] forKey:@"dropbox.sync.nonce"];
        [defaults synchronize];
        break;
    }
}
account = [[DBAccountManager sharedManager] handleOpenURL:url];