Account Log In

[elinainc]

Is it possible to view multiple accounts through the API without having to log into each account separately? 

[JeremiahFitbit]

No, you need to obtain consent from each person your app would like to access data on behalf of. Because each authorization is subject to different scope permission, your app will need to request data for each person in a separate request. Individual requests also enable more efficient caching of data through the use of ETags.

[elinainc]

Each one of my clients has given their login and password to setup their authorization. I just don’t want to log into each account to see if each client is burning the necessary amount of calories. Is there a way to switch between accounts without putting in their username and password?

[JeremiahFitbit]

No, you will need to sign in to each account to authorize your app.

In general, this is a not a recommended security practice. People should authorize third-party apps on their own.

[elinainc]

Thank you for help. I just want to clarify something. Once I authorize the app to work with my API there’s no way to switch between users without logging into each separate account?

[JeremiahFitbit]

Not sure I understand your question. You'd only have to sign into each user's account to authorize your app once.

The end result of the OAuth 2.0 authorization process is an access token. Your app will have a unique access token for each user who authorizes. Your app will use the access token to make API requests.

If you have a web server app, you can use the Authorization Code Flow, the access token will only work for 1 hour, but can be refreshed indefinitely by using the refresh token flow.

If you have a native or browser app, you can use the Implicit Grant Flow, the access token can last up to a year, but then your app will have to ask the user to re-authorize your app when it expires.

[elinainc]

I currently have the access token; but my developer said that once I access one person’s account, in order for me to access another client, I will still need to re-enter their username and password to view the data being obtain through the API. Is this correct?

[JeremiahFitbit]

For each person, your app would have an access token. So if you have 20 users, you'd have 20 access tokens. If you wanted to get each person's daily step count (or whatever data you want), your app has to make 20 API requests—1 request for each user using the specific user's access token.