Grabbing steps via PHP script, dropping into mysql (oauth 1 to oauth 2)

[staze]

All,

So, the time has come to finally update my Oauth1 script, but I'm a bit confused by something. 

All I do is daily, I have a script run on my webserver that grabs my step count from the previous day, then adds that to a mysql database. Fine, right? Only, I'm confused why I even NEED to use oauth for this since I've set my step data to "Anyone" in Privacy. So I would think an un-authed api call should be able to retreive this... and maybe It can, I'm just using the wrong URL.

I hate that I have to update my script from oauth1 when all I'm doing is reading data. I could see disabling stuff like sets, deletes with oauth1 since it's not overly secure... but reads? Who cares?!

Anyway, any help would be greatly appriciated. I'm also a bit concerned about the language in one of the documents saying the authorization code can't be embedded... it's a script! It never checks anything but my own step count. BTW, I'm using PHP, and I wrote about my whole process here: http://www.staze.org/retrieving-steps-data-fitbit-api/

Thanks for any help! 

[JeremiahFitbit]

All API requests require a user access token, even if you set your data privacy settings to "anyone". This is an important security requirement.

You need to:

1. Obtain a user access token. This is done by completing an OAuth 2.0 authorization flow. I suggest the Authorization Code Grant Flow since you have a server-side script.
2. Use that access token to access data. You can use any HTTP request library. To make a request using an OAuth 2.0 access token, add an Authorization header with a value of "Bearer yourAccessTokenHere". See Making Requests.
3. When the access token expires, you can refresh it to get a new one. See Refreshing Tokens.

---

staze wrote:

I'm also a bit concerned about the language in one of the documents saying the authorization code can't be embedded... it's a script!

---

If you're creating a PHP server application access via your Web browser, this requirement doesn't apply to you. The requirement to not embed the Fitbit OAuth 2.0 authorization flow is for native applications that might use an embedded browser.

[staze]

Gotcha. I'll give these a shot and post back. 

Only other question would be, do I really need to refresh or just grab a new access token since it's only once a day? 

Thanks! 

[JeremiahFitbit]

Once you've authorized your app, your app should refresh the access token instead of going through the OAuth 2.0 authorization flow again.

The access token lasts 8 hours, but you can refresh it anytime after it expires (such as the next day).

[Kaantayla]

Hello Staze,

Were you able to upgrade your code to OAUTH 2?

[staze]

Hi there,

I did not. I gave up for the longest time, then switched to using IFTTT. It pulls from fitbit daily, then does a webservices query to a page I set up that grabs the values and dumps into an SQL database. 

Works pretty well.