Displaying FitBit data on personal website

[dill800]

Hi all,

I'm interested in adding a feature to my personal website that displays my most current heart rate from the fitbit API. I understand the authentication process, but I was wondering if there would be a way to not have it prompt the client for credentials since it would be pulling from my profile data only. How would I go about doing this?

[Gondwana]

I gather you're investigating the Web API. The most recent reading that will give you was when your watch last synced.

If you want closer to real-time data, you can use the Device and Companion APIs. However, that requires running a custom clockface/app continually on your watch (and there is no background processing option), and your web site would need to be able to accept fetch() or WebSocket data. But at least you wouldn't need to go through the authentication process!

[dill800]

Hi Peter,

Thanks for the reply! Using the most recent reading that my watch gives since it was last synced would work. Right now i'm using Postman to hit an endpoint that is giving me my heart rate for each minute of the day, which is what i wanted. However, I do have to pass in an auth token to do this, and after decoding it it says it expires in a week. 

Is there any way to set the lifetime of an auth token to a year or have a lifetime token without using the device and companion API? 

[Gondwana]

Investigate using a refresh token.

I would have thought that the most recent reading you could get through the Web API would be typically 20 minutes delayed, rather than real-time.

[dill800]

Hi Peter,

I looked into using a refresh token, but it looks like that still requires the client to physically log in. The implicit grant flow gives me access to an access token that lasts a week, but no refresh token option exists for implicit.

Do you know any other way to make the data from my fitbit profile public? Or at least make it so that clients dont have to log in and already have access when hitting the endpoints

[Gondwana]

I see what you mean. According to this, you should be able to obtain auth tokens that are good for 30 days. Other than that, you'd need to use an authorization code grant flow.