Fitbit is changing the servers that make outgoing webhook calls (subscription notifications)

[Gordon-C]

On January 8, 2019, Fitbit will be changing the servers that make outgoing webhook calls (subscription notifications) for the Fitbit Web API.  As a result, the IP address and hostnames will be changing.   During your FCrDNS process, you will see the subdomain name for {subdomain_name}.fitbit.com change.  If you follow the instructions in the Fitbit Web API documentation for verifying the IP address and hostname of the webhook source, we do not expect this migration to negatively impact your application.

As communicated in our documentation (https://dev.fitbit.com/build/reference/web-api/subscriptions/#security), your FCrDNS should only validate that the IP address returns a subdomain on fitbit.com.  Please do not rely on the name other than it ending in fitbit.com.  Also stated in the documentation, we request that you do not attempt to whitelist by IP address.  Our subscription API is scaled dynamically as necessary to deliver notification in real-time.

Thanks!

The Fitbit API Team

[Gordon-C]

Update: We started to make the change to the servers that make outgoing webhook calls, but experienced a problem.  We are planning to start making the change again the week of January 21, 2019.  We will post an announcement when the migration is finished.  

[mike_EV]

What is the current status of this change? It seems like things started to seriously break on the Fitbit side ever since this change was started.

Is there a rollback plan? What exactly is the issue?

Not only can the public not use the Fitbit phone app properly, but it seems also that API login keeps breaking when the captcha is presented.

[Gordon-C]

Hi @mike_EV,

We haven't started the migration yet.  I'm assuming the problems you're experiencing are related to something else.  Would you provide some more information on the problems you are experiencing?

1. When you say the public can not use the Fitbit phone app properly, what does this mean?  What behavior are you experiencing with using the phone app?
2. When you say the API login keeps breaking when the captcha is presented, would you walk me through the steps you're following to recreate this problem and what is the result?  If you're getting an error message, please provide the complete error text or a screen shot.

Gordon

[mike_EV]

I was working on my various projects when around 8pm PST I was unable to get my Fitbit phone app to show my current watch face. When I pulled up the community page, I also wasn't able to render the page. I don't remember the exact error now. I just figured it was because of some change on Fitbit's end, and would be resolved soon enough. Since that time, there have been multiple times that the Fitbit phone app doesn't show me the current watch face, I just get a spinning icon until it finally times out and returns me back to the profile screen. I have also had multiple watch faces users tell me the same thing. They think it has something to do with my watch face, which it doesn't.

Regarding the API access, I can use VSCode at work (presumably because I obtained a new token on Tuesday morning), but when I got home Tuesday night I was unable to login (subsequent attempts to login from my home machine are all the same failure). I have deleted my cache, switched to another browser to hopefully obtain a new token, but to no avail. When I auth by launching npx fitbit, it opens my browser, shows me authentication successful, but when I return to VSCode it just says "Login Failed": Invalid response and error about < in JSON response. I don't have that exact error because I dumped my cache, but I can send you the exact error when I get home. I am guessing that my home pc is using a cached token, but where is that token kept? How can I manually remove it?

My node_modules and package-lock.json are the same at work and at home. I have a git repo that holds the package.json (with only the dependencies section), which then allows me to update all the packages into 1 location, then I have symbolic links within the project folders that link to the node_modules and package-lock.json.

All these issues seem to have started on Monday 8pm PST. I have been operating in the same configuration for over a month without issue.

[mike_EV]

The error message returned is "Login failed: invalid json response body at https://api.fitbit.com/oauth2/token reason: Unexpected token < in JSON at position 0". This is after I am sent to a Cloudflare page to confirm that I am not a robot through captcha. Did Fitbit change their servers and need to whitelist the server in Cloudflare? Everything I try fails. Different computers, system restore, you name it... I've tried it!

[mike_EV]

I connected up my laptop to my hotspot phone, and I was able to get a token. Would there be some reason why CloudFlare (I presume is something being used by Fitbit to prevent DDoS attacks) would start blocking my exernal IP address?

[Gordon-C]

There could be several reasons why your IP address might have been blocked (e.g. constantly logging in/out, creating a bunch of new accounts, etc).   If you private message me your IP address, I can investigate it for you.

Gordon

[Judasrage]

dudxntIt 

[Judasrage]

It doesn't sync Gordon. Obvious by the 500 or so posts all over the site. 

[Gordon-C]

Hi @Judasrage

The changes to the proxy servers are not used during the syncing process.  

Gordon