Refresh Token Invalid

[Jeff_New_Ocean]

Hi Fitbit Team,

I have 3 users in our app that on May 26th that began returning the error message upon automatic access token refresh - existing users that have been getting data / refreshing token for quite a while:

Response: {"errors":[{"errorType":"invalid_grant","message":"Refresh token invalid: aaec9662c22560981f59b82fda9f80fbe3230d23e2398a6f291c4e080cf6ff6f. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}

Looking at our request log for prior refresh requests, it appears we had been requesting the refresh and saving the new token data properly. What would be the best way to troubleshoot if anything strange occurred with these users? (e.g. maybe they revoked access and we missed the subscription notification?)

Also, is there a way that I could request a valid token for the user manually and get them fixed up in our database?

We are using the regular authorization code grant flow.

Thanks, Jeff

[Jeff_New_Ocean]

Let me know if I can PM some UserIds, last known tokens.

[cleye]

Hi Jeff,

I have also experienced a very similar issue. I had 2 users fail their access token refresh on the night of April 26th , receiving the same response error that you did. These 2 users had also been refreshing tokens for a while previously.

Currently our proposed solution is to prompt the user to reauthorise their Fitbit account, but ideally would be better if there was a way to manually refresh the token like you said.

Out of curiosity did your tokens fail at the exact same time or over a period on May 26th? 

We had one token refresh fail at 15:36 on 26/04 and another at 02:09 on 27/04.

Thanks

Cleye

[Jeff_New_Ocean]

Hi Cleye, it was three various times throughout the date on May 26th, similar to your scenario.

[Jeff_New_Ocean]

Hi Team,

We had 80 more users that had this issue over the weekend, not sure if there was a server issue? 

Is there any way I can get these users whole again without forcing them to reauthenticate with the application?

[Gordon-C]

Hi @Jeff_New_Ocean and @cleye,

My apologies for the delay as we juggle holiday schedules within the support team.   I will take a look at this problem today and report back soon.

Gordon

[Jeff_New_Ocean]

Hi @Gordon-C I PM'd you some examples.

[skip.coon]

Hi, 

I am also having the same issue here.  Is here any update on this?  Is there an automatic way to get the tokens sync'd?

[Jeff_New_Ocean]

Thanks @Gordon-C. I will be out until Monday. Can you include fred.marinari@newoceanhealth.com on responses as well?

[Gordon-C]

@Jeff_New_Ocean ... yes I'll reach out to you and Fred on this issue directly.    

@skip.coon and @cleye ... I'll reach out to you directly using the email address in your profile to collect more information to debug.   I don't want you to include in PII or sensitive data in the community forums while I investigate.

[Gordon-C · Accepted solution]

I have reached out to each of the people above, individually.   You should have received an email from me/Fitbit developer support team.   If you do not see the email, please check your spam inbox.

To clarify, there are several reasons for the invalid refresh tokens.   Based on the timing when some of these issues occurred, I'm assuming the problems are not related.   We have suggestions in our Developer Guide and Troubleshooting Guide which explain the common causes and solutions to refresh token issues.