I can no longer get authentication_token and refresh_token

[tiagoreul]

Yesterday I was able to get the authorization and refresh token using the Authorization Code Flow.

Today, after no changes, the /oauth2/token endpoint replies with "errorType":"invalid_grant":

{"errors":[{"errorType":"invalid_grant","message":"Authorization code invalid: [code] Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}

I've tried with different accounts.

-- EDIT --
I've tried to delete and create a new application, and I've tried copying the requests directly from the tutorial. Still not working. My request looks like this:

curl -X POST -i -H 'Authorization: Basic <base64 of clientId:secret>' -H 'Content-Type: application/x-www-form-urlencoded' -d "clientId=<clientId>" -d "grant_type=authorization_code" -d "redirect_uri=<redirect-uri>" -d "code=<code returned in callback>" https://api.fitbit.com/oauth2/token

[IoanbsuFitbit · Accepted solution]

tiagoreul,

You can only use the code that you received from Fitbit only once. Once you exchange this code for refresh token+access_token, the code will be marked as invalid.

Once your access_token expires you can use refresh_token to get new access_token+refresh_token pair.

See https://dev.fitbit.com/apps/oauthinteractivetutorial?applicationType=SERVER for more details. At 1 you receive the code, at 1A you exchange it to the access_token+refresh_token pair. At 4 you can exchange you current refresh_token to a new refresh_token + access_token pair.

Beware that once you exchange your refresh_token it will be marked invalid and you'll get new refresh token instead that you'll need to use in future.