OAuth2.0 Authorization Code Grant returns 400 error

[Sanghuuuun]

I am trying to build a web application that monitor the heart rate of Fitbit users. I registered the application which is client type. Below is my code and I am getting an error 400.

I have two questions basically,

- The first one is what is the authorization code I recived within the url I got?

http://127.0.0.1:8887/main.html/?code=2f333819fa9164ecaadfasdfasdfasdf#_=_

is it 2f333819fa9164ecaadfasdfasdfasdf? which is right before the #? or should I include "#_=_" ?

- The second question

This is the code I am tying to request the access token. Please verify if this is correct.

var authcode = "2f333819fa9164ecaadfasdfasdfasdf";

var clientId = "XXXXXX";

var clientSecret = "xxxxxxxxxxxxxxxxxxxxxx";

var authorizationBasic = window.btoa(clientId+":"+clientSecret);

var xhr = new XMLHttpRequest();

xhr.open("POST",'https://api.fitbit.com/oauth2/token', true)

xhr.setRequestHeader("Authorization", "Basic "+ authorizationBasic);

xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

xhr.onreadystatechange = function() {

    if(xhr.readyState == 4 && xhr.status == 200) {

        alert(xhr.responseText);

    }

}

xhr.send("client_id="+clientId+"&grant_type=authorization_code&redirect_uri=https%3A%2F%2F127.0.0.1%3A8887%2Fmain.html%2F&code="+authcode);

Thanks you in advance.

[GordonFitbit]

Hi @Sanghuuuun 

Overall, that looks correct.   The redirect URL should be https, not http.   Also, the parameters in the /oauth2/token endpoint need to be body parameters.

If you've verified those to things and still getting the 400 error, would you please provide the error text that is provided with the 400 code?

Gordon