Getting new access token fails - 400 when trying to use refresh token

[JRadecki]

I have an application using the Authorization Code Grant Flow (with PKCE) in conjunction with Subscriptions. After the accessToken expires, it attempts to use the refreshToken to acquire the new accessToken. This call fails with a 400 response code on the first attempt. Subsequent POST calls to /oauth2/token fail, so we are stuck 400ing until the user re-authenticates.

[JRadecki]

Our application flow is

User Authenticates with Authorization Code Grant Flow with PKCE

Application exchanges for OAuth tokens

On 1/16/2023 at 11:40:37 CST we store the access and refresh token

The Application gets subscription updates and calls various endpoints to get fitbit data

On 1/17 at 9:55:23 CST we try to refresh the token after receiving a 401 from the heartrate endpoint

As far as I can tell, we are not trying to use this refresh token more than once.

[GordonFitbit]

Hi @JRadecki 

Would you please try to reproduce the problem again where you try to refresh the token on the first attempt and it fails?   After you do, please provide me with the timestamp when you attempted this and your client ID.

Thank you!

Gordon

[JRadecki · Accepted solution]

Hi Gordon,

Looks like we were improperly storing the *new* refreshToken and on subsequent calls using the old one. I had to add additional logging in order to catch this. Appreciate your response.