And further to my initial post on this matter:
To overcome the problem of your callback seemingly not functioning if setup in a Delphi DLL, I have created a small application that authorises Dropbox and passes the token to my DLL calling what is left of the signin process. This application uses a form so your callback will work. The form is not visible and (should) require NO interaction from the user.
If I use an internal Browser AND CANCEL out of the authorisation form (failing the authorisation) the AuthFormClose event is triggered (the AccessDenied event is not triggered), but I at least know the user has finished (and not authorised). Whilst it is a bit inelegant, I can check for a variable like 'Authorised' and if set to false then I know to terminate my application and that the user has not authorised Dropbox (ie. I would set 'Authorised' to true in the OnConnect event if it were triggered).
If OTOH I use an external browser and cancel out of that by closing the browser page, the AuthFormClose event is NOT triggered. In fact, as near as I can work out NOTHING is triggered. I have no way of knowing that the user simply killed the authorisation webpage. My application has nothing to indicate it has not connected and nothing to say that the authorisation has failed.
Again, how can I work around this, since external browser access is required for Dropbox to put your app into production????