Cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Invalid authorization token type error ??

------------------------------------------------------------------------------------------------------------------------------------

start page

<html>
<head>
<title></title>
</head>
<body>
<a href="https://www.fitbit.com/oauth2/authorize?response_type=token&client_id=22CD8T&redirect_uri=http%3A%2F...">
Login to Fitbit
</a>
</body>
</html>

------------------------------------------------------------------------------------------------------------------------------------

call back page

<html>
<head>
<title>Insert title here</title>
<script type="text/javascript">
var url = window.location.href;
var access_token = url.split("#")[1].split("=")[1].split("&")[0];
var userId = url.split("#")[1].split("=")[2].split("&")[0];

var xhr = new XMLHttpRequest();
xhr.open('GET', 'https://api.fitbit.com/1/user/' + userId + '/activities/date/2021-04-15.json');
xhr.setRequestHeader("accept", 'application/x-www-form-urlencoded');
xhr.setRequestHeader("Authorization", 'Bearer ' + access_token);
xhr.onload = function () {
if (xhr.status === 200) {
console.log(xhr.responseText)
}
};

xhr.send(null);

</script>
</head>
<body>

</body>
</html>

------------------------------------------------------------------------------------------------------------------------------------

error code

-> https://api.fitbit.com/1/user/9BSK2R/activities/date/2021-04-15.json

-> {"errors":[{"errorType":"system","fieldName":"n/a","message":"Authorization Error: Invalid authorization token type"}],"success":false}

------------------------------------------------------------------------------------------------------------------------------------

Best Answer
0 Votes
1 REPLY 1

Hi @SunsetRunner.   Receiving that error when executing the activities endpoint typically means the authorization header needs to be set to "Bearer" followed by the access token.   But, it looks like you're doing that in your code.   Can you inspect the web page through the browser to make certain the authorization header is defined correctly?    You could also try using the values generated by your code in a curl statement to see if the data is correct.

Gordon Crenshaw
Senior Technical Solutions Consultant
Fitbit Partner Engineering & Web API Support | Google
Best Answer