Been struggling with this for days.
Our setup:
App type: Server
Oauth flow passes and we get the access_token for the user.
We use the following scopes: acitvity,heartrate,profile
We make a GET request to list existing subscriptions.
We register any missing subscriptions:
- using fetch we do the following: await fetch('https://api.fitbit.com/1/user/-/activities/apiSubscriptions/<our-id-gen>.json', { method: 'POST', headers: { Authorization: 'Bearer <access_token>' } });
It always returns with 403 "The caller does not have permission"
When I try to do the following: curl -X POST -H "Authorization: Bearer <access_token>" <the same url as above> it creates the subscription and returns the details.
Issue is only happening on our localhost server. As we are trying to prototype the flow and activities data handling on our end, we do not have the luxury to deploy this to our stage servers. Do you guys not accept access from localhost? What's the deal?
