Cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

ErrorType : invalid_client - Invalid authorization header format

ANSWERED

The message error is 

{"errors":[{"errorType":"invalid_client","message":"Invalid authorization header format. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}bool(true)

 

My php code is: 

$code = $_GET['code'];

$auth_header = array( "Authorization" => base64_encode(CLIENT_ID . ":" . CLIENT_SECRET) , "Content-Type" => "application/x-www-form-urlencoded" );

$url = "https://api.fitbit.com/oauth2/token";

$access_token_setttings = array( "code" => $code, "grant_type" => "authorization_code", "client_id" => CLIENT_ID, "redirect_uri" => REDIRECT_URI );

$curl = curl_init($url);

curl_setopt($curl, CURLOPT_POST, true);

curl_setopt($curl, CURLOPT_HTTPHEADER, $auth_header);

curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($access_token_setttings)); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);

$result = curl_exec($curl);
curl_close($curl);

$results = json_decode($result, true);
var_dump($result);
 
Regards
Johnny
Best Answer
1 BEST ANSWER

Accepted Solutions

@johnnysalgadom I'd suggest you to try building the curl command and executing it from command line and see if it work or not. 

Also are you passing the Authorization header as a header OR as a parameter?

View best answer in original post

Best Answer
0 Votes
6 REPLIES 6

@johnnysalgadom the way you generate Authorization header seem to be correct.

How ever I don't see in your code that you're using "Basic" prefix.

Basically the authorization header should look something like:

"Authorization: Basic base64_encode(CLIENT_ID . ":" . CLIENT_SECRET)" 

For example :

"Authorization: Basic QVNEMjM0OjNmOGI2NDYwNzlkMjdkc2ZnZGZnc2RmZ3NkZmcwNzM0MQ=="

 

Best Answer

Thanks, @IoanbsuFitbit

I modified my code:

$auth_header = array(
"Authorization" => "Basic " . base64_encode(CLIENT_ID . ":" . CLIENT_SECRET)
, "Content-Type" => "application/x-www-form-urlencoded"
);
 
But result is the same: 
"errors":[{"errorType":"invalid_client","message":"Invalid authorization header format. .."
 
Thanks in advance,
Best Answer
0 Votes

@johnnysalgadom I'd suggest you to try building the curl command and executing it from command line and see if it work or not. 

Also are you passing the Authorization header as a header OR as a parameter?

Best Answer
0 Votes

I have the same problem.

 

I initially had no client secret when set up my app, but it turned up in the portal eventually.  

 

I used the my client id with my client secret to make a Basic auth header as the documentation says.  I did this through Postman and the OAuth test page that you have provided.  They both get the same error.

It is almost as if you auth server doesn't have my Client ID and/or client secret properly recorded.  I am sure that I calculated the basic auth value as both systems tried gave the same result.

The error is:

{
    "errors": [
        {
            "errorType": "invalid_client",
            "message": "Invalid authorization header. Client secret invalid. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
        }
    ],
    "success": false
}

 

What am I missing? 

Best Answer
0 Votes

@Daniel_RB please PM to me your app id and I'll be able to verify if your app secret is set correctly or not.

Best Answer
0 Votes

I am testing the header curl

I change my code by :

 

$auth_header = array(
"Authorization: Basic " . base64_encode(CLIENT_ID . ":" . CLIENT_SECRET)
, "Content-Type: application/x-www-form-urlencoded"
);
 
It works fine,
Thanks.
Best Answer
0 Votes