Client credentials

[AlfredJP]

Hello everyone,

First of all, thank you for having me!

I am new to the community and I'm trying to learn about oauth2 and all its inner workings, as well as the Fitbit API. The fitbit API documentation is incredibly clear, clean, and thorough. I've learned a lot from it so far. 

What I have not been able to make very clear for myself is what the 'basic' token, or the client id and, more specifically, client secret are used for. From what I understand they are needed for the Authorization Code Grant Flow only, and even then only when requesting a refresh token. Is that correct?

And then there is the "client access key", which can be retrieved from /oauth2/token using the basic token and setting grant type "client_credentials". The docs showed me how to get it, but I am utterly clueless about its use. What API endpoints take this key? It appears to have no scope whatsoever. 

Kind regards,

Alfred

[GordonFitbit · Accepted solution]

Hi @AlfredJP 

Welcome!   Let me try to clarify some things for you.

"grant_type=client_credentials" is not supported for querying user data.  We recommend you use the Authorization Code Grant Flow instead, "grant_type=authorization_code".   When the user consents and is redirected to your callback URL, the authorization code for that user is provided in the URL.   The Basic token is used to signal Fitbit that your registered application defined by the basic token is allowed to obtain the access token and refresh token for this user.   Once you have these tokens, you'll use the access token or Bearer token to query the user data.

[AlfredJP]

Hey @GordonFitbit 

Thank you for your explanation. That clears things up a bit for me.

I am now only left wondering why the client access key is implemented by Fitbit at all. It does give me a Bearer token, but like you said, it grants no access to user data (which is only right, of course). What's the use of this option? From what I gather from the official oauth2 docs (rfc6749 section 4.4) it is used to access resources under the control of my registered app. But what resources would those be for say a web-app?  Will any potential app I create have to host files on the web-api.fitbit.com server?

[GordonFitbit]

Client Credential authorization flow is used for APIs that don't access Fitbit user data.  Those APIs are not documented in the Web API documentation.  Your application should focus on the Authorization Code Grant Flow.