401 response on api Log Food

[Cortex]

Hi,

I am getting a 401 Unauthorized access response when trying to submit a POST request to /1/user/-/foods/log.json

I have verified my request oauth_signature at http://nouncer.com/oauth/authentication.html which matches with the signature my code produces.

Below is what my request looks like, will appreciate pointers into why it is not going through correctly.

POST https://api.fitbit.com/1/user/-/foods/log.json HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Authorization: OAuth oauth_consumer_key="foo-bar", oauth_nonce="0bpar0d9xjar6vwe", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1437092999", oauth_token="foo-bar", oauth_version="1.0", oauth_signature="sig-bar"

Host: api.fitbit.com

Content-Length: 67

Expect: 100-continue

foodId=14662809&mealTypeId=1&unitId=259&amount=1.00&date=2015-07-16

[JeremiahFitbit]

Please validate your base string and signature using our OAuth 1.0a debug tool or use OAuth 2.0.

[Cortex]

The tool https://dev.fitbit.com/apps/oauthtutorialpage does not support supplying parameters for POST request.

[Cortex]

Also, i can confirm that the with no parameters the OAuth signature on https://dev.fitbit.com/apps/oauthtutorialpage and my code is same. But hitting the get food api still returns 401 error.

[JeremiahFitbit]

With the OAuth 1.0a signature, it doesn't matter if the parameters are URL or body parameters. To test, put your body parameters as URL parameters and compare the base strings and signature.

[Cortex]

I have an exact signature match between signature generated by my code and  https://dev.fitbit.com/apps/oauthtutorialpage with parameters being added to request url.

And still the response if error 401.

[Cortex]

Copying the error message:

{"errors":[{"errorType":"request","fieldName":"n/a","message":"Read-only API client is not authorized to update resources"}],"success":false}

what does "Read-only API client" mean?

[JeremiahFitbit · Accepted solution]

This error means that your application does not have write permissions. You'll need to change this in your application settings at https://dev.fitbit.com/apps/ . Note: this will immediately invalidate all previously granted user access tokens.