How to add authorized scopes with client credentials method

[poupi]

Hello, 

I try to access to my personal temperature but I get the "

API client is not authorized by the resource owner to access the resource requested." error.

I guess the issue is I don't say any scope. Here's what I do : 

I get my access token, here's the CURL : 

curl --location --request POST 'https://api.fitbit.com/oauth2/token' \
--header 'Authorization: Basic MYTOKEN' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Cookie: JSESSIONID=E66137AAF7B39115F77E0A7A8810A95B.fitbit1; fct=afbca93311fc4c0bbc8279d5c4898ddc' \
--data-urlencode 'grant_type=client_credentials'

Here's the response : 

{
    "access_token": "MYTOKEN",
    "expires_in": 28800,
    "scope": "",
    "token_type": "Bearer"
}

Scope is empty, is it why I can't query my temp ? How can I change that? 
Here's the request I make :

curl --location --request GET 'https://api.fitbit.com/1/user/2TP6GS/temp/skin/date/MYDATE.json' \
--header 'Authorization: Bearer MYTOKEN' \
--header 'Cookie: JSESSIONID=E66137AAF7B39115F77E0A7A8810A95B.fitbit1; fct=afbca93311fc4c0bbc8279d5c4898ddc'

Thanks

[GordonFitbit · Accepted solution]

Hi @poupi 

Client Credentials authorization flow is not supported by Fitbit to pull data through the Web API.   See https://dev.fitbit.com/build/reference/web-api/developer-guide/authorization/#Other-Supported-Author...

You'll need to use the authorization code grant flow or implicit grant flow.   The scopes are listed in the authorization URL.  I would recommended checking out this section of the documentation for instructions on authorizing a user; https://dev.fitbit.com/build/reference/web-api/developer-guide/authorization/#Authorization-Code-Gra....   If you're pulling only your data, you can opt out of the PKCE pieces.

Let me know if you have further questions.

Best,

Gordon