Fitbit Authorization page will not keep me logged in, every time the app start up

[AkiTC]

My app user has entered the account information and logged in with the Keep logged in check box on the Authorization page, but every time the app is launched and the Authorization page is displayed, the user is prompted to enter the account information.

This phenomenon is occurring only for some app users.

The app has used Implicit Grant Flow as as the authentication method.

In order to avoid this problem, could you tell me the conditions under which the account information input screen is displayed every time and how to avoid it?

Best regards,
Aki

[JohnFitbit]

Hi @AkiTC,

Welcome to the forums! 

Because of how the Implicit Grant Flow is designed, this would be the expected user experience for consenting to share data with 3rd party applications. When an access_token expires under the Implicit Grant Flow, the user must go through the authorization flow to grant access again, resulting in a less than ideal user experience.

I recommend switching over to the Authorization Code Grant Flow, which allows your application to manage the access tokens on the backend. When the access token expires, your application will use whats called a "refresh token" to obtain a new access token and refresh token pair to extend access to the user's data. This prevents the Fitbit user from having to log in and consent each time as opposed to the Implicit Grant Flow. Also note that the Implicit Grant Flow is not a recommended authorization flow as its not as secure as the Authorization Code Grant Flow.

Alternatively, the way you set up your authorize url could be causing the user to log in and consent each time. If your authorize url contains "prompt=login consent", then you are forcing your Fitbit user to login and consent each time.

I hope this helps. Let me know if you have any questions.

[AkiTC]

Hi @JohnFitbit 

Thank you for replying.

I would like to apply Authorization Code Grant Flow to my app if possible.

But the app is live and is still being used by users.

Is it necessary to suspend users' app usage in order to make app modifications and switch authentication methods?

Is it possible to switch authentication methods without stopping users from using the app?

Best regards,
Aki

[gogal]

Thanks a lot for this explanation! I've recently faced the same issue and I'm looking for  solution. I'd srart with using the Authorization Code Grant Flow.