Fail to get access_token

[JonathanR.Tech]

Hello, I created a new Fitbit Web API in "Personal" mode with the "Implicit Grant Flow".
This in order to make a call to the API from a core.net asp project.

I force the Implicit Grant Flow by passing the argument answer_type = token during my authorization request. =>

 return builder.AddOAuth ("Api" + API_TYPE.ToString (), API_TYPE.ToString (), options =>
            {
                options.ClientId = clientId;
                options.ClientSecret = secretId;
                options.CallbackPath = new PathString (callbackPath);
                options.AuthorizationEndpoint = "https://www.fitbit.com/oauth2/authorize?response_type=token";
                options.TokenEndpoint = "https://api.fitbit.com/oauth2/token";
                options.SaveTokens = true;
                options.Scope.Add ("activity heartrate location nutrition profile settings sleep social weight");

When I challenge the fibit API I arrive on the login page; everything is going well I authenticate myself but I receive in return this answer:

https://localhost:44324 /ApiFitbit #access_token=eyJhbGciOiJIUzI1 .......

that produces an exception :
System.Exception: An error was encountered while handling the remote login.
---> System.Exception: The oauth state was missing or invalid.
--- End of inner exception stack trace ---
at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.MigrationsEndPointMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.DatabaseErrorPageMiddleware.Invoke(HttpContext httpContext)
at Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.DatabaseErrorPageMiddleware.Invoke(HttpContext httpContext)
at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

Wan you help me please ?

Regards.

[JohnFitbit]

Hi @JonathanR.Tech,

Welcome to the forums!

It looks like you've done everything correctly. If you take a look at the URL you provided:

"https://localhost:44324 /ApiFitbit #access_token=eyJhbGciOiJIUzI1......."

You can see that you were provided with an access_token after your authorization. Your application needs to store this access token as you'll need this to make requests.

I hope this helps, let me know if you have any additional questions.