I have a few questions

[u84six]

I'm currently working on a web-based solution and it seems I have most of the oauth2 token exchanging working. I'm testing with my own fitbit account and registered my test web app with my account. But there's still a few mysteries.

1. I'm finding that I have to reauth every now and then. For the same user, shouldn't I only have to auth once and then my app can just go through the cycle of making requests and refreshing the token without having to direct the user to the grant auth page? I'm using response_type=code. When my app can't retrieve data from fitbit, I try refreshing, and that doesn't always work. But then I run through the grant auth ui and redirect, and everything starts working again. Do you know what could be causing that?
2. When making a requesting to get activities, I'm not receiving the values that show on my dashboard. For example, when I send [date].json with today's date, this is what I receive:
   

   {
       "activities": [],
       "goals": {
           "activeMinutes": 30,
           "caloriesOut": 2751,
           "distance": 8.05,
           "floors": 10,
           "steps": 10000
       },
       "summary": {
           "activeScore": -1,
           "activityCalories": 0,
           "caloriesBMR": 1689,
           "caloriesOut": 1689,
           "distances": [
               {
                   "activity": "total",
                   "distance": 0
               },
               {
                   "activity": "tracker",
                   "distance": 0
               },
               {
                   "activity": "loggedActivities",
                   "distance": 0
               },
               {
                   "activity": "veryActive",
                   "distance": 0
               },
               {
                   "activity": "moderatelyActive",
                   "distance": 0
               },
               {
                   "activity": "lightlyActive",
                   "distance": 0
               },
               {
                   "activity": "sedentaryActive",
                   "distance": 0
               }
           ],
           "elevation": 0,
           "fairlyActiveMinutes": 0,
           "floors": 0,
           "lightlyActiveMinutes": 0,
           "marginalCalories": 0,
           "sedentaryMinutes": 1440,
           "steps": 0,
           "veryActiveMinutes": 0
       }
   }

   but when I go to my dashboard, I see that I have 483 steps and 960 calories. What could I be doing wrong that would return empty values?
3. When making an Active Token Request, what is the purpose of the callback url? The access token is retrieved with the response, not the callback.

If you need more info about my code, please let me know.

Thanks

[u84six]

Regarding item 2., I'm now starting to see changes in the information. It seems like it took a long time for the server to update even though the fitbit app successfully synced with the server earlier in the day. I'm not sure why there was no data coming back from the server. For example, steps now reflect what I see on the dashboard, but this was coming back 0 for a while even though the dashboard was showing a number greater than 0. Any explanation?

Thanks

[JeremiahFitbit]

When you sync your tracker, the data is immediately available everywhere. There shouldn't be a delay. Much of the fitbit.com web app uses the same Fitbit API that you're making requests to.

[JeremiahFitbit]

---

@u84six wrote:

1. I'm finding that I have to reauth every now and then. For the same user, shouldn't I only have to auth once and then my app can just go through the cycle of making requests and refreshing the token without having to direct the user to the grant auth page? I'm using response_type=code. When my app can't retrieve data from fitbit, I try refreshing, and that doesn't always work. But then I run through the grant auth ui and redirect, and everything starts working again. Do you know what could be causing that?

---

What's the error that you receive when you try refreshing? If you're getting an error that says the refresh token is invalid, it means that the user either revoked access or that your app has already used the refresh token (it can only be used once). Check that you don't have any race conditions and that you are storing the token every time it is updated.

[JeremiahFitbit]

---

@u84six wrote:

3. When making an Active Token Request, what is the purpose of the callback url? The access token is retrieved with the response, not the callback.

---

I don't know what you mean. What is the HTTP request that you are making?

[u84six]

---

@JeremiahFitbit wrote:

---

@u84six wrote:

3. When making an Active Token Request, what is the purpose of the callback url? The access token is retrieved with the response, not the callback.

---

I don't know what you mean. What is the HTTP request that you are making?

---

I'm talking about the Access Token request. That documentation says to provide a return url, but the access token and refresh token is in the response to the call, not being sent using a post to my return url.

[u84six]

---

@JeremiahFitbit wrote:

---

@u84six wrote:

1. I'm finding that I have to reauth every now and then. For the same user, shouldn't I only have to auth once and then my app can just go through the cycle of making requests and refreshing the token without having to direct the user to the grant auth page? I'm using response_type=code. When my app can't retrieve data from fitbit, I try refreshing, and that doesn't always work. But then I run through the grant auth ui and redirect, and everything starts working again. Do you know what could be causing that?

---

What's the error that you receive when you try refreshing? If you're getting an error that says the refresh token is invalid, it means that the user either revoked access or that your app has already used the refresh token (it can only be used once). Check that you don't have any race conditions and that you are storing the token every time it is updated.

---

The error I receive in general is saying that I need to reauth. It doesn't really give a descriptive error.  I also made sure that the refresh token changes on every access_token request.

[JeremiahFitbit]

If you provide the exact error text, it's easier to know exactly what's happening.

I suggest you use the free Runscope Traffic Inspector tool so that we can see exactly the requests being made.