Refresh Access Token

[SunsetRunner]

Hi Fitbit Community,

I am dealing with the application of getting Fitbit footsteps data developed 2 years ago. Starting from 18May, the data import is not allowed. I am new to the Fitbit API so I am not sure how to fix the problem. It is developed as follow to get the access token of each user:

1. login to a user account
2. application shall browse "https://www.fitbit.com/oauth2/authorize?response_type=token&client_id=[XXXXXX]&redirect_uri=https%3A...
3. redirect to "https://www.[company].com/fitbit/callback#access_token=[XXXXXX]&user_id=[XXXXXX]&scope=heartrate+activity&token_type=Bearer&expires_in=9923538"
4.  redirect to authorization page to allow all data
5. save the access token from the url

However, it is now failed in Step3. The VS default browser is IE and it is shown "This site is not secure". So not able to access to authorization page and not able to revoke the token.

[SunsetRunner]

using (HttpClient client = new HttpClient())
{
string encodedAuth = Base64Encode("XXXXXX:xxxxxxxxxxxxxxxxxxxxx");
var content = new FormUrlEncodedContent(new[]
{
new KeyValuePair<string, string>("token", staff.AccessToken),
});

//var content = new FormUrlEncodedContent(values);

client.BaseAddress = new Uri("https://api.fitbit.com/oauth2/revoke");
client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Basic", encodedAuth);
client.Timeout = TimeSpan.FromSeconds(30);

HttpResponseMessage response = await client.PostAsync("https://api.fitbit.com/oauth2/revoke", content); <-------Error occurred in this line
string responseString = await response.Content.ReadAsStringAsync();
return response;
}

[JohnFitbit]

Hi @SunsetRunner,

Welcome to the forums!

Before I jump into any conclusions, can you DM me a screenshot of your application details at dev.fitbit.com?

It sounds like there is confusion between which authorization flow you are using to authorize your users. The authorization URL you provided is associated to the Implicit grant flow because you have response_type=token in your URL parameters. The subject of your post indicates that you are using the authorization code grant flow since the refresh token endpoint is only used in this style of authorization.

Can you let me know if you are using the authorization code grant flow or the implicit grant flow? 

Hope to hear from you soon!

[JohnFitbit]

This was resolved via email. Root cause was due to the deprecation of TLS 1.0 and TLS 1.1. For reference, please see https://community.fitbit.com/t5/Web-API-Development/Deprecating-Support-for-TLS-1-0-and-TLS-1-1-on-M...