OAuth get stuck in Custom Tabs/firefox or any browser on phone in Android

[devsarathsvs]

whenever I call the 

https://www.fitbit.com/oauth2/authorize?response_type=token&client_id=<CLIENT_ID>&redirect_uri=https://my_redirect_url&scope=activity nutrition heartrate location nutrition profile settings sleep social weight&expires_in=604800

it get stuck at 
https://www.fitbit.com/login/transferpage?redirect=https%253A%252F%252Fwww.fitbit.com......

this page

[Gordon-C]

Hi @devsarathsvs 

What is sounds like is you're calling the /oauth2/authorize endpoint and you are being redirected to the https://www.fitbit.com/login/transferpage?... site.   Are you being asked to log in?

Gordon

[devsarathsvs]

yes, it was showing the login page, then I logged in, it happens after the login, also I think the issue is it's not redirecting to my App, because when I copied the URL (https://www.fitbit.com/login/transferpage?... ) and paste it on chrome on my PC it's redirecting to the URL

I tried many ways, I can't get the app to just simply login and get a token back to my app, can't even find a good documentation/tutorial anywhere

[devsarathsvs]

cant add any custom scheme, I can only give HTTPS URL as redirect_url, every time I try to log in, in the end, it won't redirect to the app, it just loads that redirect_uri in the chrome/customtab, no popup, no redirection to app

[devsarathsvs]

and one more thing, when I give redirect_url as recommended, like "https://finished" it will get redirected to something like this "https://finished/#access_token=eyJhbGc" but it will show in the browser "This site can’t be reached" and it won't redirect to the app, even though I added scheme="https" and data="finished" in the manifest file

[Gordon-C · Accepted solution]

Hi @devsarathsvs 

After you log in, are you presented with the scopes / consent page or do you get sent to the transferpage URL? 

The redirect URL is suppose to be a location in your application that will extract the access token or authorization code from the URL.   For example, let's pretend your redirect URL is https://myapplication.com/callback.  Once you log in and select your scopes, the user is redirected to https://myapplication.com/callback/#access_token=sdfgsdgsf.   The service at https://myapplication.com/callback/ will need to extract the access token from the redirect URL and use it when making the API calls.   I suspect the reason you're not presented with the login page each time is because the user has already consented to this  application and the application hasn't made any changes to the scopes it is requesting.   If you want to be presented with the scope page again, you'll need to revoke consent through the user's Fitbit account.