SOLVED: HelloJS for Web App, Multiple Scopes Failing

[Ricebandit]

Hi All,

I'm working on my first Fitbit API app and am using HelloJS to handle all of the OAuth calls.

I got my authorization process happening when I only request one scope. As soon as I ask for more than 1, I get the following error:

"invalid_scope - The requested scope is invalid, unknown, or malformed: profile,activity"

Here's my init() snippet:

hello.init({
	'fitbit': '227MZD'
}, {redirect_uri: 'index.html', scope: 'profile, activity'})

I'm thinking it's the formatting of the scope field. I've tried the following: 

scope: 'profile, activity'

scope: ['profile', 'activity'] 

scope: 'profile,activity'

scope: 'profile activity'

scope: 'profile+activity'

Any ideas?

[Ricebandit]

Found my solution. HelloJS seems to replace spaces with commas, so "profile activity" becomes "profile,activity".

Solution: "profile%20activity"

[JeremiahFitbit]

Spaces are the official and only correct scope delimiter according to the OAuth 2.0 framework. This looks like a bug in HelloJS.