OAuth2 Access Token Request Clarification

[Qualcee]

The documentation shows this:

POST https://api.fitbit.com/oauth2/token
Authorization: Basic Y2xpZW50X2lkOmNsaWVudCBzZWNyZXQ=
Content-Type: application/x-www-form-urlencoded

client_id=22942C&grant_type=authorization_code&redirect_uri=http%3A%2F%2Fexample.com%2Fcallback&code=1234567890

In the example, client_id is part of BOTH the Authorization header AND the request body. I've done several OAuth2 implementations and I have not seen in in both places, but okay fine, the RFC doesn't specify (http://tools.ietf.org/html/rfc6749#section-4.3.2). I'm just verifying that it is required in both places.

[JeremiahFitbit · Accepted solution]

client_id is optional in the body for this request.