OAuth2.0 unable to change scope

[BubbleSpot]

Hi,

I am trying to get heart rate information from API-Get-Time-Series with OAuth2.0 access token.

My previous scope are activity, nutrition, profile, settings, sleep. Now I have added heartrate into the scopes, but the server cannot recognize that the scope has changed, it just sent back the authentication code directly. 

How can I reauthenticate if I want to change the scope?

[DeepaFitbit · Accepted solution]

Hi,

I tried changing scopes and it seems to work for me. The change in scope triggered a reauthorization. Find below the authorization URL before I changed scope and after I added Heartrate scope. Could you please compare your authorization URL and check for any discrepancies? 

Without Heartrate - 

https://api.fitbit.com/oauth2/authorize?state=66&redirect_uri=http%3A%2F%2Flocalhost%3A18080&respons...

With Heartrate - 

https://api.fitbit.com/oauth2/authorize?state=33&redirect_uri=http%3A%2F%2Flocalhost%3A18080&respons...

[BubbleSpot]

Thanks. I see my problem. According to https://tools.ietf.org/html/rfc6749, the scope must be space-delimited. 

I tried '&', '+' or ' '. Both '+' and ' ' can be used as delimiter. The server also accepted my scope parameter which is delimited by '&', but it cannot recognize the scopes.