iOS - Upload File on Dropbox (User Login)

I don't get it with the Dropbox API.

I got an app with CoreData. The user can choose if he wants to upload the SQlite file to Dropbox. So i made a settings tab where he can de-/activate the Dropbox sync and enter Dropbox username and password. (Yes, I know that Dropbox doesn't want to store the password).

The SQLite file should be uploaded, if the user changes anything. So I don't need an ViewController for Dropbox functions.

What I want is something like a DropboxHelper class (NSObject), with a function like

+ (void)uploadFile;

In my Dropbox account, I created an App. The App Key and App Secret I use in my AppDelegate:

DBSession* session = [[[DBSession alloc] initWithConsumerKey:@"KEY"consumerSecret:@"SECRET"]autorelease]; <br>
[DBSession setSharedSession:session];
[session release];

For the upload I need a DBRestCl开发者_Go百科ient. In my upload function I test if the session is linked. If not, login the user:

if (![[DBSession sharedSession]isLinked]) {
        [self.restClient loginWithEmail:@"USERNAME" 
                      password:@"PASSWORD";  
}

But the session is always linked?! And I have to init the DBRestClient like this:

restClient = [[DBRestClient alloc] initWithSession:[DBSession sharedSession]];

So what I don't get:

I need the APP KEY and APP SECRET to use the API (so its the API Key)?

How do I login the User if the session is already linked? (I don't want to use the DBLoginController for login)

If I don't init the session in AppDelegate, how can I init the DBRestClient with a session?

Is it generally possible to use the API like this? Without a Viewcontroller and use NSObject instead?

https://www.dropbox.com/developers/reference/bestpractice covers this.

Never handle user login and password information. All application authentication is done using tokens exchanged via the Dropbox mobile app or website and the methods described in the authentication tutorial.

Another way to say this is that Dropbox does not want to put users in the position of trusting an app developer with their passwords.