Trying to understand what expectations to have when connecting via the API

[BenParizek]

I'm exploring the Fitbit API and trying to connect my first app.  So far, I'm not having much luck, but I'm pretty sure most of it relates to my own struggles to understand oauth and debugging requests.

Right now, I'm just trying to understand what I can expect and wanted to share a few things I am observing and see if anyone can help me understand if these things are expected or point me in the right direction if I need to continue troubleshooting.

I've created an App (https://dev.fitbit.com/apps) and have tried out several of the PHP wrappers to connect - the oAuth1 wrapper linked in the docs, an oAuth1 wrapper setup for composer, and even have attempted connecting via oAuth2.  

In all cases, I'm getting roughly the same results: I'm able to get redirected and give my approval to allow the app to access my profile.  Upon approval, I get redirected back to my Callback URL with the proper codes in the URL.  But, that's as far as I get.  

1. It seems, at this point I have approved the app to have access to my profile but it never shows up in the list of "My Applications" that have been approved to access my account (https://www.fitbit.com/user/profile/apps).  Never is actually a little wrong, it has showed up twice, but not under any reliable or predictable circumstances.  If I remove the apps access and try to re-add it, again, it doesn't display.  I've been trying lots of settings, so it's possible it worked just once or twice and I didn't notice under what conditions, but I can't recreate this as much as I try.  So, first, what should my expectations be here?  When you hit "Allow" and approve an app to access your profile, should it immediately appear in that list?  Is there any delay?  Is there any reason I would get a positive response and redirected properly to my callback URL and the app would not get approved properly?

2. When the app does get approved, each time it has had the label "Access & Write".  In my app settings I only have "Read" access enabled.  Why is "Write" access appearing in the connected app description if I have the app settings set to "Read Only"?

Cheers.

[JeremiahFitbit]

Your application must exchange the authorization token (in the callback) for an access token as the final step of the OAuth process.