Looking to develop a way to get multiple users data for research

[ibrahim2808]

I am currently working on a research project with my university and we want to get the intraday data of the research participants so we want to develop a server side application to request user data. I have look throughout the internet and couldnt find a straightforward answer to this, I have some development experience and would like to know the simplest way to get this data for our research. Do I have to create a web app, or can I do a script which constantly queries the user data once per day for example?

[Gordon-C]

Hi @ibrahim2808 

You can create a web application or a script to query the user's data.  There are only a few requirements.

1. Which ever method you use to call the endpoints, you will need an OAuth2 library for that query language.   See https://dev.fitbit.com/build/reference/web-api/developer-guide/libraries-and-sample-code/ for a list of known OAuth2 libraries.

2. Each user will need to consent to share their data with your client ID.  The steps to setup the authorization flow can be found in our Getting Start page, https://dev.fitbit.com/build/reference/web-api/developer-guide/getting-started/.  You can present the authorization URL to the user either in a web application or email.

Let me know if you have any further questions.

Gordon

[ibrahim2808]

So if I go with sending the authorization through email would I have to
keep refreshing the tokens periodically through each script run lets say
each 1 hour. If it fails for whatever reason would the user have to
authorize the data again?
Also are there any sample code for suchs script.

[ibrahim2808]

I was also thinking of the following if anyone can help,

-Create web app where user will login provide access authorization.(how frequent would they need to login or once they give us access it would last a long time before they need to authorize again?)

-Once logged in code is saved on a secure file in the server

-Script running once per hour uses the provided code or token to get the data of the user using the web api and store it securely on the server.

Would this work or are their any flaws in this?

[RogersSong]

Hi,

I did everything according to the tutorial. The only concern is the lifetime of tokens from users. 8 hours of lifetime is not enough.

So, anyway to lengthen it to one year? The "Implicit grant flow" section is not available now for "client" app type.

[Gordon-C]

Yes, you will need to refresh the tokens when they expire.   We do not recommend automatically refreshing the tokens but this generates unnecessary work if the user is not syncing their data.   Instead, you keep calling the endpoints with the user's access token until you get the HTTP Status 401 Unauthorized with the message "Access token expired".   See 401 Unauthorized.  After receiving this message, then refresh the user's token.

We have examples of what this would look like in the documentation.   See Refresh Token.

[Gordon-C]

One the user goes through your authorization flow and your application generates the access and refresh tokens, the user should not need to go through the authorization flow again.   You'll want to keep the 2 tokens and keep refreshing them as the access token expires.   See Using Tokens Effectively.  Following these steps will allow your application constant access to the user's data until they revoke consent.

Again, I don't recommend refreshing the token automatically.   It makes it difficult troubleshooting why data is not populating for the user.   Instead, refresh the tokens when the access token expires.   Also, you can implement Subscriptions so your application get notified when a user has uploaded new data to be downloaded.   Lastly, if you are still not getting data for a user, you can use the Get Devices endpoint to find out when the user last synced their device.   

[Gordon-C]

Hi @RogersSong 

The tutorial and documentation demonstrate the Authorization Code Grant Flow, which is the most secure method for consent.   As long as you maintain the access and refresh tokens, your application will have constant access to the user's data until the user revokes consent.   Using the implicit grant flow is not a great alternative.   One, it exposes the access token in the URL and opens your application to man-in-the-middle attacks.   Two, after the token expires, your application loses access to the user's data.   To gain access again, the user would need to complete the authorization flow again.

The only time I recommend using the implicit grant flow is testing your application against your own Fitbit account.  The security risk is low and you're putting your own data at risk.

[aaroncoleman]

If you'd rather not develop / host a custom software application, we have a software product called Fitabase (https://www.fitabase.com) that makes it very to collect / monitor / export Fitbit data for research. Please reach out with any questions!