All Access Tokens Suddenly Invalid

[TheRealMrG]

We had a problem with the queue processor that pulls updates from the Fitbit API overnight and it stopped at around 01:18 (UTC). I cleared the fault and restarted it at 09:55 and a number of updates went through. It then had another issue and stopped again but this time after starting it again at 10:08 all of the tokens seem to be invalid. For each API call I am getting a 400 response and the error "Refresh token invalid: " followed by the token.

I asked one of my colleagues to disconnect from Fitbit in our app and go through the OAuth process again and he seems fine now. Not keen on having to tell all of my other customers to do this though! Any ideas what I can do to sort it?

Thanks,

John

EDIT: I spoke too soon! It's not all access tokens, only some of them. Could the delay in our processing have caused some refresh tokens to expire?

[AndrewFitbit · Accepted solution]

@TheRealMrG Refresh tokens don't expire, they become invalid if:

1. The refresh token is used

2. A user revokes access to your app

3. A user goes through Authorization again

There's a two-minute window where you can use the old refresh token to get the same response if you initially failed to store the new token.

If it's a small number of users with invalid refresh tokens, I would suggest having them re-auth your app.

[TheRealMrG]

Thanks for the explanation Andrew. I was aware of the second and third issues you listed, but not the first. What I think happened is that we tried to refresh but due to problems at our end we failed to store the resulting new tokens. This left us trying to use old tokens that were invalid.

Fortunately it only affected a small number of customers so we've worked with them to reauthenticate.

Thanks again for your help.

John

[AndrewFitbit]

@TheRealMrG No problem! Glad to hear it was only a small number of users. 🙂