Settings OAuth Button using Auth Code Flow w/ PKCE & S256

[brh55]

I'm trying to implement the OAuth settings component using the Authorization Code Flow w/ PKCE with my OAuth provider. It almost works, except that the `code_challenge_method` parameter is set to "plain", which isn't supported in a few identity services like Auth0 or Okta.

Is there any support on this or should I resort to using the client credentials flow (client id and secret) -- and is it safe to assume that the client secret can be safe hard-coded as such? Help is much appreciated, thank you!

[Gordon-C]

Hi @brh55 

"code_challenge_method = plain" is the default setting.  You can change it to S256.   Here's the information on that connection option listed in our documentation

For use with PKCE support only. Defaults to plain if not present in the request. Code verifier transformation method is S256 or plain.

Default = plain
Optional
Type: string

If Okta or Auth0 does not support S256 please let us know.   

Unfortunately, the client credentials flow does not allow for retrieving Fitbit user data.   The next safest option would be to use Authorization Code Grant Flow (without PKCE).

[brh55]

Hey @Gordon-C, 

This is in regards to the Settings API / OAuth Button Component - https://dev.fitbit.com/build/reference/settings-api/#oauth-button

I don't see any parameter to override that code_challenge_method.

[Gondwana · Accepted solution]

You might be better off posting in this forum. However, I think the news might not be good. ☹️

[brh55]

Opps, I didn't realize I posted on Web API Development! I'll repost this on the correct forum.