Issues approving accounts using OAuth2 tutorial page

[ChrisG138]

Hi, 

We have a browser app which we have previously used to collect data from watches used in research studies. 

I've been having some difficulties doing the same today: 

1.) Using the link provided on the OAuth2 tutorial page I can sometimes get to the log on screen (after deleting cache etc.) and approve the app. But when I do I get a localhost refused to connect error "ERR_CONNECTION_REFUSED" (Windows 10, Chrome, Edge, Firefox, Opera). I've tried all suggestions I could find but to no avail. 

Additionally, when I try to use the Implicit Grant Flow (for longer token duration) I get an error which reads "

The app you're trying to connect did not provide valid information to Fitbit. Please report this issue to them.". What changes should I make to be able to have longer token times? 

Thanks for your help

[GordonFitbit]

Hi @ChrisG138 

After a person logs into Fitbit and consents to share their data, logging into the Fitbit account again is not required if the scopes presented to the user during authorization has not changed.   If you want to force the scopes page to be presented during testing, you can add one of the "prompt" values to the authorization URL.   For example "prompt=login consent" will require the user to log into their Fitbit account and re-consent to the scopes every time they go through the authorization flow.

I'm assuming you're using a localhost URL as your redirect URL.  The redirect URL is suppose to redirect to a location in your application that can parse the authorization code from the redirect URL.   Instead of localhost, we recommend that your redirect URL be a location that is accessible by the internet.   Localhost has additional security restrictions and is limited to users currently logged on to your machine.

The Implicit Grant Flow is supported by not recommended.   This flow cannot prevent man-in-the-middle attacks and once the access token expires,  the user needs to re-consent to share their data.  Instead, we recommend the authorization code grant flow with PKCE.   This will provide the most secure access to the user data.   The access token only lasts for 8 hours, but we give you a refresh token to obtain a new access token.   As long as you maintain the current access and refresh tokens, you will have constant access to the user data until the user revokes consent.   If you insist on using the implicit grant flow, please private message me your authorization URL so I can determine what information is missing.

Best,

Gordon