Fitbit Access Token Expiry Issue

[vivek-nikam]

My application uses Authorization Code Grant flow to connect and access data from Fitbit. 
We also specify the expiry time while requesting access tokens. The expiry time initially set is 31536000.

Lately, we are seeing with users who newly register to our app and sync with Fitbit, their expiry time is set to 28800 which is the default value of Fitbit. While we are investigating more in our app code. Is there something that changed on the Fitbit side that I need to be aware of? 
Any help would be much appreciated. 

[Gordon-C · Accepted solution]

Hi @vivek-nikam 

When using the Authorization Code Grant Flow, the lifetime of the access tokens has always been 28800.   A expiration time of 31536000 is only supported with the Implicit Grant Flow.  See https://dev.fitbit.com/build/reference/web-api/authorization/authorize/#Request.   

Gordon

[vivek-nikam]

Thank you @Gordon-C for your quick response. So in order to refresh the user session each time, I can always make an API call to get a new access token using a refresh token right? In that, I can specify the expiry time?

[Gordon-C]

Correct.  The access token is intentionally short-lived.   The refresh token never expires but can only be used once.   When the access token expires, you'll use the refresh token to obtain a new access token / refresh token pair.  As long as you maintain the access and refresh tokens, you will continue to have access to the user's data until consent is revoked.   See https://dev.fitbit.com/build/reference/web-api/developer-guide/best-practices/#Using-Tokens-Effectiv...

[vivek-nikam]

This clears all my doubts. Thank you @Gordon-C.