Getting an error when trying to send Authorization Header for access token

[XCentric]

NOTE: I'm using ColdFusion. Here's the page that is called from my redirect URI:

<cfhttp url="https://api.fitbit.com/oauth2/token" method="POST">
<cfhttpparam type="CGI" name="Authorization" value="Basic #URL.code#">
<cfhttpparam type="CGI" name="content_type" value="application/x-www-form-urlencoded">
<cfhttpparam type="CGI" name="client_id" value="XXXXXX">
<cfhttpparam type="CGI" name="grant_type" value="authorization_code">
</cfhttp>

What else do I need to do to create the proper header? I get an error stating the following:

{"errors":[{"errorType":"invalid_client","message":"Invalid authorization header format. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}

[AndrewFitbit]

---

XCentric wrote:

<cfhttpparam type="CGI" name="Authorization" value="Basic #URL.code#">

{"errors":[{"errorType":"invalid_client","message":"Invalid authorization header format. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}

@XCentric I would check to make sure you're setting the Authorization header properly.

The Authorization header must be set to Basic followed by a space, then the Base64 encoded string of your application's client id and secret concatenated with a colon. For example, the Base64 encoded string, Y2xpZW50X2lkOmNsaWVudCBzZWNyZXQ=, is decoded as "client_id:client secret".

[XCentric]

Yes, I am doing that but I am now getting a 'grant_type' missing error but it is there.

This is ColdFusion code but you should be able to see what I mean.

<cfhttp url="https://api.fitbit.com/oauth2/token" method="POST" result="tokenResponse">
<cfhttpparam type="header" name="authorization" value="Basic xxxxxxxxx">
<cfhttpparam type="header" name="content_type" value="application/x-www-form-urlencoded">
<cfhttpparam type="header" name="client_id" value="xxxxxxxxx">
<cfhttpparam type="header" name="grant_type" value="authorization_code">
<cfhttpparam type="header" name="code" value="#URL.code#">
</cfhttp>

[AndrewFitbit]

@XCentric Can you PM me exactly what you're sending, and also the response you're getting?

[XCentric]

Hi Andrew, I just PM'd the info. Thank you for helping out.

[AndrewFitbit · Accepted solution]

---

@XCentric wrote:

---

<cfhttpparam type="header" name="client_id" value="xxxxxxxxx">
<cfhttpparam type="header" name="grant_type" value="authorization_code">
<cfhttpparam type="header" name="code" value="#URL.code#">
</cfhttp>

@XCentric Sent you a PM but I'll also follow up here. These three are suppose to be body parameters. Looks like you'll also need to add redirect_uri as a body parameter too.

[XCentric]

That did the trick. Thank you, Andrew.

[Todd_Evento]

It would be great to know what did the trick.  

I am using Coldfusion as well and getting exactly the same error even when the grant_type cfhttpparam variable is there

{"errors":[{"errorType":"invalid_request","message":"Missing 'grant_type' parameter value. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}

[XCentric]

Todd, here's what worked for me...

You're most likely using the wrong type attribute in your cfhttpparam tag. Use the "formfield" type as I did below.

<cfhttp url="https://api.fitbit.com/oauth2/token" method="POST" result="tokenRefresh">
<cfhttpparam type="header" name="authorization" value="Basic xxx Big Ol' Long String xxx">
<cfhttpparam type="header" name="content_type" value="application/x-www-form-urlencoded">
<cfhttpparam type="formField" name="grant_type" value="refresh_token">
<cfhttpparam type="formField" name="refresh_token" value="#arguments.refreshToken#">
</cfhttp>

Hope this helps, bud.

~ Brian

[Todd_Evento]

Thanks Brian 

I'll give it  a try ...