Migrating iOS App Users To OAuth2 Using Implicit Grant Flow

[brcuhal]

Given that I have an existing IOS app that uses the OAuti 1.0a API, is there a way to upgrade existing installations so that the users do not have to re-authorize? 

The documentation says (in the Upgrading to OAuth 2.0 section) regarding making a call to obtain an OAuth2 token from an OAuth1 token:

"The Authorization header must be set to Basic followed by a space, then the Base64 encoded string of your application's client id and secret concatenated with a colon."

But as an iOS app using implicit grant flow, I don't have the secret in the app (by design) The docs do seem to indicate that you can upgrade to an implicit grant flow: 

"Additionally, for clients transitioning to the Implicit Grant Flow, you may utilize the expires_in parameter to request access tokens longer than 1 hour."

and presumably, you get back an implicit grant token. But how do I accomplish this in an iOS app?

Thanks!

[brcuhal]

Hoping someone can answer this, we're coming up to the deadline 🙂 

[JeremiahFitbit · Accepted solution]

Hi @brcuhal,

If you're using OAuth 1.0a in your iOS application today, you're already shipping your client secret.

If you want to upgrade people from OAuth 1.0a to OAuth 2.0 without them having to re-authorize and you do not have a server-side component to your app, you'll need to keep your client secret in your iOS app for as long as you want to use the Upgrade Token Flow.

My suggestion is to keep this upgrade functionality in your application for a period of time long enough for most of your userbase to have upgraded. Then, remove your client secret when you remove the Upgrade Token Flow. Optionally, you could then reset your client secret in your app settings on https://dev.fitbit.com once enough of your userbase has upgraded to the version of your iOS app without the Upgrade Token Flow.