OAuth2 Tutorial Implicit Authorization Expiration not Working

[maximum411]

I am trying to get a token that expires in 1 year for implicit authorization in the tutorial. However, even when I enter the sanctioned value of 31536000, as listed in the dev reference (https://dev.fitbit.com/build/reference/web-api/oauth2/), it always seems to automatically set the expiration to 1 day. It will list my expiration time in the URL link, but when I click the auto-generated URL, I end up with an expiration value of 1 day in the address bar. Is there a way I can get authorization to expire in a year?

[JohnFitbit · Accepted solution]

Hi @maximum411,

Welcome to the forums!

Have you tried testing this in the OAuth 2.0 tutorial for your application? I've attempted to reproduce on my end and I am successfully receiving a token that has a 1y duration.

You must ensure sure that your authorization url specifies the "expires_in=31536000" parameter

https://www.fitbit.com/oauth2/authorize?response_type=token&client_id=<clientId>&redirect_uri=<redirect_uri>&scope=activity%20nutrition%20heartrate%20location%20nutrition%20profile%20settings%20sleep%20social%20weight&expires_in=31536000

In the authorization page, where you select which data to share, ensure that the predefined duration has been applied and shows as 1 year before clicking "allow". Ultimately, it is up to the user sharing their data on how long they want to share their data for even though the authorization url can specify a predetermined duration. After consent, the user should be returned to your application's site with an access token and duration:

https://<redirect_uri>/#access_token=<access_token>&user_id=<user_id>&scope=profile+weight+location+nutrition+activity+settings+sleep+social+heartrate&token_type=Bearer&expires_in=31536000

I've also found that if there is a typo in your "expires_in=31536000" parameter, you'll be routed to an authorization page which will show that access has a duration of 1d instead of 1y. From there, you can still change the defined duration from 1d > 1y and click "allow" and you should still receive an access token with a 1y duration.

I hope this helps. Let me know if you have any additional questions.

[maximum411]

Thank you. The issue was that I only set the expiration parameter after authorizing. When I set it before authorizing it worked.