Authorize 'invalid_request - Missing response_type parameter' when using 'state' query parameter

[aedwip]

I am working on a prototype data collector for a research project. participants join the study using a web form. They have to agree to participate and enter a unique participant id sent to them in a separate email. The participant id needs to be forwarded to my redirect url so that we know how to map fitbit data to participants. 

I am using the authorization api. I can get it work as long as I do not try and pass any extra data. 

https://dev.fitbit.com/build/reference/web-api/authorization/authorize/  say there is some way to use query string parameter 'state' we can use to send extra data

This is my url

www.fitbit.com/oauth2/authorize?
response_type=code
&client_id=XXXX
&redirect_uri=https://www.XXXX.edu/fitbitWebAPISubscription
&scope=activity heartrate location
&expires_in=604800
&state=XXX-123

Any suggests would be greatly appreciated

Andy

[aedwip · Accepted solution]

I figured out how to make this work. Your form must use action="post". The action url should be the URL with the query string generated by the ?oath tutorial debug tool??? This uri has a query string with thing like scope, redirect_uri, ... It looks like your form can only have one input. the name must be 'state' . If you have other input fields they will not be passed to your redirect_uri.  I guess you could use javascript to remove additional fields and concatenate all the values in the state.value 

your subscribe  get end point will be called . The 'state' query parameter will be passed in the query string

Hopefully this same other time future

Andy