Oauth invalid data to Fitbit after submitted app for review however seems to work fine

[benedebr]

Hello!

So I have this app that wants to communicate with the Fitbit web API for submitting your weight. After getting everything to work just fine I submitted the app for review but got the response:

The app has connectivity issues. After attempting to login from the companion settings, the following error is received: "The app you're trying to connect did not provide valid information to Fitbit."

And I'm unable to reproduce this. Deleting the app in the simulator and revoking the app from permission on my personal settings page (fitbit.com) and then reauthenticating works just fine. Both on my own watch with the same version and in the simulator.

Settings block looks like this:

<Oauth
  settingsKey="oauth"
  title="Login"
  label="Fitbit"
  status={(() => {
    if (props.settingsStorage.getItem("oauth")) {
      return "Authenticated";
    } else {
      return "Not authenticated";
    }
  })()}
  authorizeUrl={secrets.oauth.authorizationUrl}
  requestTokenUrl={secrets.oauth.tokenRequestUrl}
  clientId={secrets.oauth.clientId}
  clientSecret={secrets.oauth.clientSecret}
  scope="weight"
  onAccessToken={async data => {
    debug(data);
  }}
/>

And the secrets json looks like this:

{
  "oauth": {
    "clientId": "redacted",
    "clientSecret": "redacted",
    "tokenRequestUrl": "https://api.fitbit.com/oauth2/token",
    "authorizationUrl": "https://www.fitbit.com/oauth2/authorize"
  }
}

I've double checked the client secrets and they are correct.

Googling tells me that usually with this kind of error you get a "developer message" describing exactly whats wrong. For example if the client secret is invalid. However the app review team didn't include any such message for me and since I'm not able to reproduce it I'm not sure where to start debugging this.

Does anyone have any suggestions on any other things I can try to get the error reproduced? Or any other advice at all?

For example a "harder" way to wipe the oauth integration before attempting reauthentication?

I'm thinking about deleting the integration entirely and creating a new one however that feels wrong considering it works well on my devices.

[JonFitbit]

I tried your app on iOS and after login, I see this error in the console, with "visit settings to login" shown on the device.

TypeError: Request with GET/HEAD method cannot have body.

I had a quick look in the companion and removing the body from openUrl() fixes that error, but obviously you need that for POST.

Anyway, I hope this helps. You can find us on Discord if you need more help with the review.

[benedebr]

That error sure makes sense and I'll get right on to fixing it. It's a bit mysterious though that I haven't seen that error in the console at all. Neither with the simulator nor on Android. Maybe iOS has a newer version of fetch or something?

Don't think it's related to the Oauth issue though. And I think I actually found the solution there - I'd set "Personal" as the app type in the Oauth integration setting. Which allows only *me* as the uploader of the app to log in. After switching to "Server" and verifying it still worked I submitted the app for review again and it got approved!

Now I'm just gonna fix the fetch-error you mention then release it.

Thanks for all the help!