One application multiple users data

[ritu.jain]

Hi Fitbit Dev Team,

I have gone through many of the forum questions but I haven't got a direct response so I'm posting this here on a new thread.

I see that you have mentioned at many places that one application can access multiple user's data provided the application uses the client id, client secret & respective tokens which is generated during the process. Here, when you refer the term "application", you are refering to the end-user or third-party application which is calling Fitbit API and fetching data. But, here my question is - does each user (whose data is to be retrieved) shall create a new application under section "https://dev.fitbit.com/apps - Register an app"? Why this question, because, the client id and secret are 1-2-1 related to a fitbit applciation rather than the user.(Like url -
https://www.fitbit.com/oauth2/authorize?client_id=227XKJ&response_type=token&scope=sleep&redirect_ur..., where client_id is the client id of the registered application & not the user). Is there a possibility of using only one such app and get data of multiple users? If yes, can you point me to some documentation which will help. If not, say I have 500 customers in production(which in my case may be more), is there a non-manual process of creating so many applications?

Also, since I do not have a device(will be having few soon), I want to know if this application is same as the fitbit mobile app?? 

Thanks a lot for your help in advance. Hoping for an early reply.

Regards,

Ritu.

[AndrewFitbit · Accepted solution]

---

@ritu.jain wrote:

But, here my question is - does each user (whose data is to be retrieved) shall create a new application under section "https://dev.fitbit.com/apps - Register an app"?

---

@ritu.jain No, but each user would have to authorize your app, which gives you an access token to fetch data on their behalf. You can browse our API documentation for more information.

---

@ritu.jain wrote:

Also, since I do not have a device(will be having few soon), I want to know if this application is same as the fitbit mobile app??

---

@ritu.jain Not sure what you mean, but if you're referring to your own app, then no.

[ritu.jain]

Thank you Andrew, I just logged in to reply to my own question as I found the answer & saw your answer 🙂

Thank you so much for the reply. The code generated is separate for each user and a single fitbit app is letting me fetch data of two different users. 

Thanks a lot for your prompt reply, really appreciate!

Regards,

Ritu.

[thejay1991]

Hi, Can you please mention the steps how did you achieve this?

I am also facing the same issue

[chriswhitfield]

What information do we need to provide to get an access token for an individual user? Their userID? And will users receive notification in their fitbit profile that Application X wants their data?

[AndrewFitbit]

@chriswhitfield A user would have to go through the auth flow for your app, at which point the user can grant access to "Application X" to access their Fitbit data.

[chriswhitfield]

Ok, thanks Andrew. How do we prompt a user to go through the auth flow portion? Say I have a user John Smith and I know his fitbit user ID, how is he notified that he needs to go through this auth flow?

[tommycarstensen]

I have the same question.

"Ok, thanks Andrew. How do we prompt a user to go through the auth flow portion? Say I have a user John Smith and I know his fitbit user ID, how is he notified that he needs to go through this auth flow?"

[ARadmanesh]

It's intresting, I had the same understanding after I've read the documentation and by the logic of OAuth and scopes. But now that I have an application (Server) with Intraday access enabled and I'm in the process of development; I've experienced that for some (in fact many of them) API endpoints will return a 500 error with different error message, like You don't have sufficient access, or the user should have authorized your app to access the data. Initially I came to a conclusion that only with the access_token of the owner of the application you would have access to everyone's data, Alas I was totally wrong!

In the end, now to fetch each device data I use it's user's access token to access the API and everything works just fine now!!  It's strange, I would really like to know why this happens and if it is somehow intentional, what's the purpose and advantage of doing that?