OAuth 2.0 Mobile Flow With My Own Backend API

[JonKragh]

Hi-

This is probably a general OAuth Architecture question - but maybe you can provide feedback.

I have a website and mobile app that I'm integrating fitbit into.  

I have the Authorization Code Grant flow working for the website.

Now I want to do the mobile app, but once the mobile app is connected to fitbit, I want my mobile app to call my own server which would then call fitbit using a token.

What's a good architecture here? Should I have my mobile app launch a page on my website, which then goes through the same sequence as my website and then I store the token on my server and somehow redirect back into the mobile app once that sequence is complete?

The downfalls I see of this are launching a webpage from the mobile app might mean the user needs to login to my website then fitbit even though they are logged into my app.

The downside to the implicit grant flow seems that if i get the token on my client, pass that to me server for storage, then that token can expire quite often and I would need to reprompt the user to connect to fitbit all the time.

Any guidance here is appreciated.

Jon

[JonKragh]

I figured out a way to send the user to my website in Mobile Safari from the Mobile App, initiate the server side Authorization Code Grant Flow and then redirect from my server as a deep link into my app once the Authorization Code Grant flow is complete.

Client Secret is all on the server and I get refresh tokens.

With Authorization Code Grant Flow and refresh tokens can my app call on behalf of the user indefenitley without the need to have the user reauth my app? (barring that they remove my app from either my side or fitbit)

Thanks!

Jon