Help with sending POST requests

[duffman828]

Hi Everyone!

I am attempting to create an app that will pull Heart Rate information and place it into a database. So far, I've taught myself a little bit of working with non-OAuth APIs with PHP, but I'm not married to any programmng language. 

So far, I've manually typed in the Authorization Code Grant Flow URL that is provided in the OAuth 2.0 manual (and have gotten the "code" parameter in the callback URI) , but I've been trying to figure out how to get past the Access Token Request part. I understand that I need to send a POST request with headers, but whenever I try to do that (using PHP), all I get back is a blank page. I can almost promise that I'm doing the POST request incorrectly, but I just don't know how to go about doing it the right way.

Any help I can get will be GREATLY appreciated!

Thanks!!!

[duffman828]

Hello again!

So I've actually switched to JavaScript to see if I can get anything to work. When I load the page, I can get code running, but I always get the 401 Unauthorized error message. I'll include the code I'm using

function loadXMLDoc()
{
var xmlhttp;
if (window.XMLHttpRequest)
  {// code for IE7+, Firefox, Chrome, Opera, Safari
  xmlhttp=new XMLHttpRequest();
  }
else
  {// code for IE6, IE5
  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
  }
xmlhttp.onreadystatechange=function()
  {
  if (xmlhttp.readyState==4 && xmlhttp.status==200)
    {
    document.getElementById("myDiv").innerHTML=xmlhttp.responseText;
    }
  }
xmlhttp.open("POST", "https://api.fitbit.com/oauth2/token", true);
xmlhttp.setRequestHeader("Authorization", "Basic [Base64 of ID : Secret]=");
xmlhttp.send("client_id=******&grant_type=authorization_code&redirect_uri=http%3A%2F%2F127.0.0.1%2Ffitbittest2.html&code=[same code that I recieved as a URL code in the previous step]");
}

Again, and help is MORE than appreciated!

[JeremiahFitbit]

Hey @duffman828,

A few things to try here. First, you really, really don't want to do the Access Token Request in client-side JavaScript because you never want to expose your client secret. I assume you only did this to easily test, but definitely don't do that in production.

1. Verify that your Authorization header is correct. You might try https://www.base64encode.org/ . In your code, it looks like you might be adding an extra '='.

2. Add the 'Content-Type: application/x-www-form-urlencoded' header.

[duffman828]

Hi @JeremiahFitbit, 

Thank you for your reply! It's been a while, but I've finnally been able to get back on this project and your solution worked! Thank you very much. 

At your advice, I've started working on a server-side code that will hopefully function the same way my JS code did. I'm stuck on somthing I can only assume is going to be a very stupid problem, though.

I have this:

<?php

$URL = "https://api.fitbit.com/oauth2/token";
$aHTTP['https']['method']  = 'POST';
$aHTTP['https']['header']  = "Authorization: Basic BASE64";
$aHTTP['https']['header'] .= "content-type: application/x-www-form-urlencoded";

$context = stream_context_create($aHTTP);
$contents = file_get_contents($URL, false, $context);

echo $contents;
?>

But I can't figure out where/how to send the final request line. In Javascript, it was 

xmlhttp.send("client_id=******&grant_type=authorization_code&redirect_uri=http%3A%2F%2F127.0.0.1%2Ffitbittest2.html&code=[same code that I recieved as a URL code in the previous step]");
}

But I'm just not sure how to put that into PHP.