Having trouble using curl (Implicit Grant Flow) to sucessfully request and acquire an access token

[fvtc]

I’m trying to use curl to programmatically request and retrieve an access token from  https://www.fitbit.com/oauth2/authorize.
While I get a response, it does not contain the expected access token/code.

Details:

What I’m trying to do:
Using curl on a macbook, I’d like to request and get an access token completely programmatically.
I’d then use the access token to make calls via the web spit to retrieve data from my FitBit device.
Note: I can do this manually via the Oauth 2.0 tutorial page accessed from my application’s registration page.

What I’ve done programmatically:
Note: The client id, secret, encoded auth field, cookie and redirect fields have been altered to protect privacy.

1. The script used to request and retrieve the access token/code:

more testFitBitAuth.sh

#! /bin/bash

clientId=XXXXXX
clientSecret=XXXXXXXXXXXXXXXXXXXX99f3e6d11297f
both="$clientId:$clientSecret"
convertedBoth=$(echo "$both" | base64)
authField=$(echo "Basic " $convertedBoth)

echo "Authorization field = $authField"

curl -X POST -i -H "Authorization: $authField" -H 'Content-Type: application/x-www-form-urlencoded' -d "response_type=token" -d “client_id=XXXXXX" -d "grant_type=authorization_code" -d "scope=activity%20heartrate%20location%20nutrition%20profile%20settings%20sleep%20social%20weight" -d "expires_in=604800" -d "redirect_uri=https%3A%2F%2Fwww.blahblah.com" https://www.fitbit.com/oauth2/authorize

2. Execution and Output:

./testFitBitAuth.sh

Authorization field = Basic MMMMMMMMMMMhYjI3ZTZkYzJkZjk3NGZmYmE5OWYzZTZkMTEyOTdmCg==
HTTP/1.1 200 Connection established

HTTP/1.1 302 Found
Date: Fri, 18 Aug 2017 19:10:55 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=d2392743c287c19af869852e981407a411503000000; expires=Sat, 18-Aug-18 19:10:55 GMT; path=/; domain=.fitbit.com; HttpOnly
X-UA-Compatible: IE=edge,chrome=1
Vary: Origin
Set-Cookie: fct=214a08f59ca14c2b929000000d7160bc; Path=/; Secure; HttpOnly
Location: https://www.fitbit.com/login?disableThirdPartyLogin=true&redirect=%2Foauth2%2Fauthorize%3Fclient_id%...
Content-Language: en-US
X-Frame-Options: SAMEORIGIN
Server: cloudflare-nginx
CF-RAY: 39072d0b0ac556f9-IAD

3. Reviewing the FitBit Web API Forum, my problem/situation partially matches this posting:
https://community.fitbit.com/t5/Web-API-Development/Curl-and-Implicit-Grand-Flow-access-token-OAuth2...

4. These are the differences I’ve identified between my case and the posting:
-My location (see above) is different than that in the posting (disableThirdPartyLogin missing)
-I’m using the Implicit Grant Flow example code.
-Regarding “Message 4 of 5”: Respectably, I’m looking for a solution/guidance that is tested and working, not speculation. What code actually, demonstrably works?

5. As an aside, Is this approach legal/valid? Consider the "WARNING – DO NOT embed the Authorization page” section found here:
https://dev.fitbit.com/docs/oauth2/#obtaining-consent

Already reached out to tech support and they asked me to ask the question on a forum.

[DavidSFitbit · Accepted solution]

Hey @fvtc! So it looks like you're attempting to curl the authorization page. The authorization page needs to be opened on a browser so a user can give consent to an application to make requests to the Fitbit API on their behalf. The flow is as follows:

1. Redirect the user to the authorization page using the URL you generated in your scripts and in accordance to what's documented here.
2. Once a user authorizes your application, they'll be directed to your redirect URI that you have set in your application's settings with either a code to use to request an access token, or the access token itself depending on which flow you're using.
3. From here, you can use curl to either request an access token and/or make requests to the Fitbit API.

In short, you can only use curl once you've gotten the authorization code or an access token. The authorization page (https://www.fitbit.com/oauth2/authorize) should be accessed in a browser.