ErrorType : invalid_client - Invalid authorization header format

[johnnysalgadom]

The message error is 

{"errors":[{"errorType":"invalid_client","message":"Invalid authorization header format. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}bool(true)

My php code is: 

$code = $_GET['code'];

$auth_header = array( "Authorization" => base64_encode(CLIENT_ID . ":" . CLIENT_SECRET) , "Content-Type" => "application/x-www-form-urlencoded" );

$url = "https://api.fitbit.com/oauth2/token";

$access_token_setttings = array( "code" => $code, "grant_type" => "authorization_code", "client_id" => CLIENT_ID, "redirect_uri" => REDIRECT_URI );

$curl = curl_init($url);

curl_setopt($curl, CURLOPT_POST, true);

curl_setopt($curl, CURLOPT_HTTPHEADER, $auth_header);

curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($access_token_setttings)); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);

$result = curl_exec($curl);

curl_close($curl);

$results = json_decode($result, true);

var_dump($result);

Regards

Johnny

[IoanbsuFitbit]

@johnnysalgadom the way you generate Authorization header seem to be correct.

How ever I don't see in your code that you're using "Basic" prefix.

Basically the authorization header should look something like:

"Authorization: Basic base64_encode(CLIENT_ID . ":" . CLIENT_SECRET)" 

For example :

"Authorization: Basic QVNEMjM0OjNmOGI2NDYwNzlkMjdkc2ZnZGZnc2RmZ3NkZmcwNzM0MQ=="

[johnnysalgadom]

Thanks, @IoanbsuFitbit

I modified my code:

$auth_header = array(

"Authorization" => "Basic " . base64_encode(CLIENT_ID . ":" . CLIENT_SECRET)

, "Content-Type" => "application/x-www-form-urlencoded"

);

But result is the same: 

"errors":[{"errorType":"invalid_client","message":"Invalid authorization header format. .."

Thanks in advance,

[IoanbsuFitbit · Accepted solution]

@johnnysalgadom I'd suggest you to try building the curl command and executing it from command line and see if it work or not. 

Also are you passing the Authorization header as a header OR as a parameter?

[Daniel_RB]

I have the same problem.

I initially had no client secret when set up my app, but it turned up in the portal eventually.  

I used the my client id with my client secret to make a Basic auth header as the documentation says.  I did this through Postman and the OAuth test page that you have provided.  They both get the same error.

It is almost as if you auth server doesn't have my Client ID and/or client secret properly recorded.  I am sure that I calculated the basic auth value as both systems tried gave the same result.

The error is:

{
    "errors": [
        {
            "errorType": "invalid_client",
            "message": "Invalid authorization header. Client secret invalid. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
        }
    ],
    "success": false
}

What am I missing? 

[IoanbsuFitbit]

@Daniel_RB please PM to me your app id and I'll be able to verify if your app secret is set correctly or not.

[johnnysalgadom]

I am testing the header curl

I change my code by :

$auth_header = array(

"Authorization: Basic " . base64_encode(CLIENT_ID . ":" . CLIENT_SECRET)

, "Content-Type: application/x-www-form-urlencoded"

);

It works fine,

Thanks.