Suddenly getting invalid_grant "Authorization code invalid" error?

[snowcrazed]

Hi! I've been running a small system for about a year now which always worked reliably. As of about a week ago I'm getting invalid_grant for any oauth token I try to create. No code changes on my end, I did see the topic titled "I can no longer get authentication_token and refresh_token" but I don't store the code so I think it's not relevant to my issue.

I first redirect users to "https://www.fitbit.com/oauth2/authorize" with appropriate parameters - again, these haven't changed for like a year!

The callback from fitbit provides me with the code I then use to call "https://api.fitbit.com/oauth2/token" providing the "code" I was just passed.

I can see clearly from my logs that "code" is the same as the one that fitbit called back with, and this code is not stored - it differs from other codes generated further up in the log and the state contains the unique value I generated for this oauth call!

The response from "/token" comes back with the invalid_grant error.

Any idea why this may have changed? Was there perhaps an update to fitbits oauth2 implementation I'm not aware of?

Thanks heaps!!

[IoanbsuFitbit]

There were no changes in the code flow recently as far as I can tell.

Can you please try using code flow at this page: https://dev.fitbit.com/apps/oauthinteractivetutorial and let me know if it works.

While you test it make sure that your app is not listening for callbacks with codes otherwise your app will accept the code and exchange it to token and each code can only be used once.

Also can you please confirm if its single request is affected or just some of them?