Authorization code verifier invalid error

[Gregor321]

Hello,

  We are trying to generate the token but ended up with an error "Authorization code verifier invalid". After retrieving the authorization code, I am calling the /oauth2/token end point to access the token with the parameters  client_id, code, code_verifier, and grant_type. I also  specifying the Authorization header to the request, and include the "Basic" token. Can anyone please help with the error "errorType":"invalid_grant","message":"Authorization code verifier invalid:? 

Thank you

[GordonFitbit]

Hi @Gregor321 

Would you please private message me your authorization string and the /oauth2/token endpoint which is returning the error?   

Thanks!

Gordon

[GordonFitbit]

Hi @Gregor321 

There was an error in our documentation and example for implementing PKCE.   We just fixed the documentation.   Would you please review https://dev.fitbit.com/build/reference/web-api/developer-guide/authorization/#Authorization-Code-Gra... to see if it helps.   If you still receive the error please let me know.

Gordon

[ssshar]

I'm having the exact same issue where I keep receiving the "Authorization code verifier invalid:" error. I'm absolutely sure the code verifiers match up and that I hashed and encoded the code challenge correctly. I even tested using the example code verifier and code challenge provided. I've read through the documentation, and I'm pretty sure I've followed those steps. GordonFitbit, could you please specify what was changed about the documentation and what the exact issue was? Thank you so much!

[GordonFitbit]

Hi @ssshar 

In Step 1 of https://dev.fitbit.com/build/reference/web-api/developer-guide/authorization/#Authorization-Code-Gra... the section on transforming the code verifier into the code challenge had the incorrect formula and examples.  Are you following the same steps as documented?

[ssshar]

From what I'm seeing, I definitely am! I've checked over it for several hours. I also hash/encode correctly because when I tried hardcoding the code_verifier as the example '01234567890123456789012345678901234567890123456789' I get the correct code challenge as shown in the example. And I also receive the following error from fitbit: 'Authorization code verifier invalid: 01234567890123456789012345678901234567890123456789'. And, I'm sure I'm sending the correct parameters as well to the token endpoint. Thank you so much for your help. Please let me know if you have any advice :).