HTML 401 Response

[quantu]

When my program tries to get new tokens, I am getting a 401 response with the error message: Invalid authorization header. Client id invalid.

I have been using this program for a while and have not made any changes to it.  I was not getting this error a few days ago.

[Gordon-C]

Hi @quantu 

Would you please send me the API endpoint that you're executing and the access token?

Thanks!

Gordon

[quantu]

Forgive my ignorance, but do you mean post it here? I don't see how to send it to you directly.

[quantu]

Never mind. I now see your email message.

[quantu]

https://api.fitbit.com/oauth2/token

[JohnFitbit]

Hi @quantu,

Apologies for any confusion, can you please provide me with your full HTTP request that you're sending when you receive this error? I need to see the endpoint you're calling, header, and body (if applicable)

[quantu]

Is there any way that I can do this securely? I do not want to expose my client id and secret.

[JohnFitbit]

@quantu Click on my name and you should be taken to my profile page. You should see an option to send me a message beside my profile information.

[JohnFitbit]

@quantu Thanks for sending me your HTTP request. 

The Client Id I pulled from your base 64 token is showing up as invalid. When I checked our database, your client Id didn't show up. This means that it was either deleted, or it doesn't exist.

Can you confirm that you're using the correct Client Id? You can do so by logging into dev.fitbit.com and checking your app gallery at https://dev.fitbit.com/apps. Click on your application and you should see your Client Id and Client secret.

Another thing I noticed in your POST request was that you were missing the Content-Length header. This became required a few months ago, please see https://community.fitbit.com/t5/Web-API-Development/UPDATED-May-4-2020-New-header-requirements-for-P....

Let me know if this helps.

[quantu]

Thanks for pointing out the missing Content-Length header.

I will send you a message concerning the Client Id.