RefreshToken returns NULL for valid user

[mkft]

Hi we are using OAuth 2.0 Server type and doing exactly as mentioned here https://dev.fitbit.com/build/reference/web-api/oauth2/#refreshing-tokens to get new refresh tokens and one of the users refresh tokens is returning NULL. We have intraday access approved and are testing 5 Fitbit users. Our script which runs at 1AM was able to fetch 4 users refreshtokens from database and getting steps, heart rate data without any issues. However, the 5th user refreshtoken was valid the day before but NULL since last night. we were unable to figure out the reason. 

Could you kindly help?

[Gordon-C]

Hi @mkft 

Would you please provide the exact API call you're executing along with the parameters, their value and the headers?   Please obfuscate the refresh token value.

Thanks!

Gordon

[mkft]

Thank you for the response @Gordon-C ! Please see our PHP code below...

$dataBody = "grant_type=refresh_token&refresh_token=".$currRefreshToken;

$json_result = CallAPI("POST", "https://api.fitbit.com/oauth2/token", $authcode, $dataBody);

function CallAPI($method, $url, $token, $data)    {        // create curl resource        $ch = curl_init();
        // Check if initialization had gone wrong        if ($ch === false) {            throw new Exception('failed to initialize');        }        
        $headers = array();
        switch ($method) {            case "POST":                curl_setopt($ch, CURLOPT_POST, true);                $headers = array(                    'Content-Type: application/x-www-form-urlencoded',                    'Authorization: Basic ' . $token                );                if ($data)                    curl_setopt($ch, CURLOPT_POSTFIELDS, $data);                break;            default:                $headers = array(                    'Authorization: Bearer ' . $token                );                // if get, build query string url                if ($data)                    $url = sprintf("%s?%s", $url, http_build_query(json_decode($data)));        }
        // OPTIONS:
        // set url        curl_setopt($ch, CURLOPT_URL, $url);
        // set headers        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        //  TRUE to return the transfer as a string of the return value of curl_exec() instead of outputting it directly.        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);        curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);

        // disregard SSL        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
        // EXECUTE:        $result = curl_exec($ch);        if (!$result) {            //throw new Exception(curl_error($ch), curl_errno($ch));
            die("Connection Failure");            throw new Exception("An error occurred, please try again later");        }        // Check if any error occurred        if (curl_errno($ch)) {
            die("Connection Failure");            throw new Exception("An error occurred, please try again later");        }        curl_close($ch);        return $result;    }

[Gordon-C]

Hi @mkft 

Would you please execute the following curl statement, including your values for the basic token and refresh token, and let me know the results?

curl -i -X POST https://api.fitbit.com/oauth2/token -H "Authorization: Basic <basic_token>" -H "Content-Type: application/x-www-form-urlencoded" --data "grant_type=refresh_token" --data "refresh_token=<refresh_token>"

Thanks!

Gordon

[mkft]

Thanks for the prompt response Gordon! I sent you a private message with the response.

[Gordon-C]

Thank you!!   As you see at the end of the response, you are receiving the access token and the refresh token.   So, it looks like the tokens are working as expected.   There has to be something wrong with your code.   I would suggest debugging the code and make certain the API call, headers, parameters and their values are being generated correctly based on the endpoint I provided you.