Limit on access tokens per day ?

[steven95youssef]

Hello:

I have a general question, is there a limit on how many access tokens for a user I can get per day ?

This is my call to get a new access token 

public const string BaseUrl_FitBit = "https://api.fitbit.com/oauth2/token";

public const string GetTokenPath_FitBit = "/oauth2/authorize";

var client = new RestClient(BaseUrl_FitBit);
            var req = new RestRequest(GetTokenPath_FitBit, Method.POST);
            string encoded_string = Crypto.Encrypt_Fitbit(OAuth2ClientFitBit.ClientId_FitBit, OAuth2ClientFitBit.ClientSecret_FitBit);
            req.AddHeader("Authorization", "Basic " + encoded_string);
            req.AddParameter("grant_type", "refresh_token");
            req.AddParameter("refresh_token", refreshToken);
            req.AddParameter("expires_in", "3600");

The previous code allows me to get a new access token using the refresh token, but it sometimes fails and says "Bad request"

Another question:

Is it good practice to store encrypt access token and store it on database ?

[JeremiahFitbit]

You should not refresh a person's access token more frequently than it expires. The default is 8 hours. Please do not exceed 3 refreshes a day.

What is the full response body from the Fitbit API when you get a Bad Request error? Fitbit error messages contain information on the cause and often links to documentation.

P.S. It's "Fitbit" with a lowercase 'b'. 🙂

[steven95youssef]

hahaha sorry! 

I don't get that error often, but when I do, I will be sure to look at the response body again and see if there is any information. Although I'm pretty sure I did not find any info in the response body. 

Okay so in order to not exceed 3 refreshres a day, I would have to store an encrypted access and refresh token in the database, is that good practice ?

I know I can also store it on the phone, but due to my app requirement I would either have to get a new access token every time users login or the alternative would be to store it in a database.

[steven95youssef]

here is the error: 

resp.Request
{RestSharp.RestRequest}
AlwaysMultipartFormData: false
Attempts: 1
Credentials: (null)
DateFormat: (null)
Files: Count = 0
JsonSerializer: {RestSharp.Serializers.JsonSerializer}
Method: RestSharp.Method.POST
OnBeforeDeserialization: {System.Action<RestSharp.IRestResponse>}
Parameters: Count = 5
ReadWriteTimeout: 0
RequestFormat: RestSharp.DataFormat.Xml
Resource: "/oauth2/authorize"
ResponseWriter: (null)
RootElement: (null)
Timeout: 0
UseDefaultCredentials: false
UserState: (null)
XmlNamespace: (null)
XmlSerializer: {RestSharp.Serializers.XmlSerializer}
Static members:
Non-public members:

[steven95youssef]

I really do think that since I'm consinously testing, I do get that error becasue I keep getting a new access token and due to the requirments of the project, I can not save the access token on the phone. That is why I am asking if it is okay to store an encrypted access and refresh token in a database. 

[JeremiahFitbit · Accepted solution]

You should use a server and databse to store the access token and refresh token in this situation. I recommend storing the access and refresh tokens encrypted in your database and decrypting with your server application upon retrieval and transmission to your mobile app.