API OAuth login using Facebook or Google

[mrph]

I noticed in the api docs here: https://dev.fitbit.com/docs/oauth2/#authorization-errors that it appears we can authenticate users with the Fitbit api using Facebook or Google based on the potential error responses:

Facebook account used is not associated with a Fitbit account	{"errors":[{"errorType":"invalid_client","message": "Oops! We don’t have a Fitbit account associated with that Facebook login."}],"success":false}
Google account used is not associated with a Fitbit account	{"errors":[{"errorType":"invalid_client","message": "Oops! We don’t have a Fitbit account associated with that Google login."}],"success":false}

However, there's no other documentation about this. So how do we obtain an access token from the Fitbit api if we want to authenticate the user using their Facebook or Google account? 

[JeremiahFitbit · Accepted solution]

Fitbit no longer has Google/Facebook sign in available for people going through the OAuth 2.0 consent flow.

If they have already signed in to www.fitbit.com using their Google/Facebook accounts, they won't be shown the sign in form prior to the consent form (unless prompt=login).

Google/Facebook sign in is only available in Fitbit's Web app, so it is not a commonly used feature.

[mrph]

Thanks for the clarification. Curious why they were removed.

[JeremiahFitbit]

We removed it from the OAuth consent flow's sign in form for 3 reasons:

1. Very few people who use Fitbit use this feature.
2. Google and Facebook have made breaking changes at least once a year.
3. Google's and Facebook's scripts have broken in Android Web views with no workaround, often due to unusual browser modifications by Android device manufacturers.

[darin_ce]

I know this was from years ago, but we're now seeing the Google login option on the OAuth login form for the web API, and it is indeed failing when used on Android.  Is this currently a known issue?

[JohnFitbit]

@darin_ce This is expected behavior as Google/Facebook login are not supported during the OAuth consent flow.

[darin_ce]

Thanks, good to know.  Would it be possible to remove the buttons in situations where they're not supported?

[JohnFitbit]

@darin_ce That's a great suggestion. I'll see what the team thinks as this will help reduce confusion moving forward.

[Evidation]

Do folks know if Google login is still not supported for OAuth via the Web API? We are seeing the Google login button/option on the Fitbit OAuth screen for Web API, but we are seeing issues with OAuth completing. Curious if this is expected, or if it's something that we should be able to resolve.

[JohnFitbit]

Hi @Evidation,

Welcome to the forums!

Please see our Social Login Support documentation. Currently, Google Login is not supported for consenting to 3P apps, but supported for SSO to Fitbit accounts.

Let me know if you have any additional questions.

[Evidation]

Thanks for confirming, John, appreciate it. I saw above that a request was made to remove the 'Google Login' button from the 3P app OAuth screen for the Fitbit Web API, since it isn't supported - is that still something that Fitbit is considering doing?