403 Forbidden when user go through the OAuth2.0

[yuhang]

Hi everyone,

Our team is running a project to get users' Fitbit data. The user needs to consent the Fitbit and go through the OAuth to give us the token. Recently, one of our users came across a 403 Forbidden error when she opened the authentication URL. However, there is only one case, other users can consent. I can't reproduce this problem. Does anyone get this problem and have any solution to it? 

I saw a post that tried to remove the extension, however, I don't have it.

Thank you so much!

[Gordon-C · Accepted solution]

Hi @yuhang 

I've seen a few reasons why the 403 error occurs.  Would you be able to share your complete authorization URL?   I'll need to see the values you've entered, so please don't redact anything.

Thanks!

[yuhang]

Hi Gordon,

My complete authorizaiton URL is 

https://www.fitbit.com/oauth2/authorize?response_type=code&client_id=XXXX&redirect_uri=http%3A%2F%2F...

Thank you for your help!

Best,
Yuhang

[HumaStuff]

Hi, Gordon. We have the same issue in our app.
There is one reported issue when a person gets 403 using the authorization URL, but we have 900+ successfully connected people who haven't had any issues.
It appeared only recently. The last time we tried was on 6th Jan 2025. Our team couldn't reproduce the issue.

Below is our authorization URL (clientId masked):
https://www.fitbit.com/oauth2/authorize?client_id=XXXXX&redirect_uri=https%3A%2F%2Fasthma-prod-gcp-u...

Thanks!

Huma team.

[Gordon-C]

Hi @yuhang 

When I click on your URL, the error return states

Developer information: invalid_request - The code_challenge parameter length must be between 43 and 128.

Your code challenge value is outside of that size range.  Once you fix it, the problem should be resolved.

[Gordon-C]

Hi @HumaStuff 

When I click on the URL, the state query parameter is missing the = sign and value.   Would you please post the entire URL?