How to add state in callback url to uniquely identify it

[nikhil]

Hi,

I add some parameters in callback url  during authorization to uniquely identify requests at our server end. but it seems that fitbit ignores those parameters and just redirect request to callback url mentioned in app settings.

For example:- 

if I set authorization url as :- 

https://www.fitbit.com/oauth/authorize?oauth_token=xxxxxxxxxxxxxxxxxxxx&oauth_callback=http%3A%2F%2F...

I get response at url  -- dev.funnyhealth.com/response - with parameters oauth_token and oauth_verifier but no state (which i attached with callback url.)

Many application with oauth1 authentication allow this. I am wondering if this can be achieve in fitbit also.

Thanks

Nikhil

[Doug · Accepted solution]

Yes, it can be done.  The URL provided when the app was registered and your consumer key obtained is just the default when you don't include a callback URL when you request the token.  Just add the oauth_callback parameter to the authorization header and the URL provided when you registered the application will be ignored.  Note that since oauth requires all parameters in the header to be in alphabetical order, this must precede the oauth_consumer_key parameter and be included as part of how you compute the header signature.

The example in the API docs here even include the oauth_callback parameter.  You might also want to experiment with this tool for help with debugging authorization headers and signatures.

[nikhil]

 Thank you,

I wasn't adding oauth_callback parameter in header but in url.