How to use two users on one account?

[brettr]

We'd like to check if a device is in use by our app without deauthorizing the user that has already registered the device.  Is that possible?

Below is our scenario.  User1 and User2 are on the same fitbit.com account.  But they are separate users in our app.

1.) User1 authorizes our app for their device.

2.) Sometime later, User2 also authorizes our app for their device. 

Once #2 completes, User1 will be deauthorized.  I'm guessing this happens because for fitbit.com, it is the same user and thus new tokens are issues, invalidating the old tokens that User1 has.  Is there some other way to do this check?

Thanks,

Brett

[JeremiahFitbit]

I don't think that I understand your question. A few clarifications on how Fitbit works:

- A tracker can only be paired to one user at a time.

- Users authorize your app to access their data, not their tracker. This relationship between your app and Fitbit should be thought of as one with the user, not the user's tracker.

[brettr]

Ok but that doesn't answer my question.  User1 should retain his registration.  How do I prevent User2 from trying to register the same device?

[JeremiahFitbit]

If your requirement is to maintain a many user to single Fitbit user account relationship, your application will need to manage this complexity.

Your app will need to store your app's user id, the Fitbit user id, and the Fitbit access token and token secret in a database table. Upon the second user authorizing your application, your application will get the Fitbit user's Fitbit id, query the aforementioned table to see if that Fitbit user has a connection with another one of your application's users (in this case, user 1), update user 1's Fitbit access token and token secret values, then insert a new row for user 2.

[brettr]

No - we aren't maintaining a many user to single Fitbit user account relationship.

I believe updating user1 with the values from user2 will work.  User2 will not actually register, since we display a message that the device is already registered.  But user2 has inadvertently disabled user1.  By updating user1, he will go offline briefly then back online and hopefully not notice anything happened.  Does that sound correct?

I'm not sure what you mean about adding a second row for user2.  When user2 attempted to authorize with fitbit.com, that reissued new tokens.  There is only one set of valid tokens for this Fitbit account at this point.  We must decide which of these two users get them.  In this case, it will always be the user that had registered first.  User2's attempt will not be saved and they must use a different Fitbit account.