Introspect refresh token

[Chuil]

Hi,

Can Introspect capability test also Refresh Token validity, like that ?

url: "https://api.fitbit.com/1.1/oauth2/introspect",
method: "POST",
headers: {      "Authorization": "Bearer " + access_token,
                      "Content-Type": "application/x-www-form-urlencoded"
               },
data: 'token=' + refresh_token

PS. I always got  {"active":false}

Thanks,

Charles

[JohnFitbit]

Hi @Chuil

Welcome to the forums!

According to our documentation, it does appear that only access tokens are supported in our version of the introspect endpoint. I was also able to reproduce the same response {"active":false} when entering a valid refresh token in the body of this request.

The OAuth 2.0 spec indicates that refresh tokens are also supported. With that in mind, I'll reach out to the team to see if we can implement the usage of refresh tokens in this endpoint.

For now, the best way to check the validity of a refresh token is to use the refresh token in a token refresh request. If your refresh token is valid, you'll be provided with a new refresh token and access token. If its invalid, you should see a 400 returned along with the message:

{"errors":[{"errorType":"invalid_grant","message":"Refresh token invalid: [access_token]"}],"success":false}

See: https://dev.fitbit.com/build/reference/web-api/oauth2/#refresh-token-errors

Thanks for bringing this to our attention! Let me know if you have any questions in the meantime.