Unable to unsubscribe from subscription webhooks

[JohnAtPaceline]

The current Web API's Delete Subscription endpoint requires a valid access token (or refresh token that can be used to get an access token).  However, we have thousands of users who have deleted our app, leaving us with no way to refresh their expired tokens.  In short, we get thousands of webhook notifications a day for users who are not in our system.  

Trying to use an expired access token fails, as you'd expect:

{"success":false,"errors":[{"errorType":"expired_token","message":"Access token expired: eyJhbGciOiJIUzI1NiJ9.XXXXXXXXX.YYYYYYYYY. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}]}

And attempting to get a new access token from an expired refresh token also fails.

Furthermore, there's no way to call this endpoint on their behalf (e.g. using Basic auth as described here).  When trying this, we get a pretty descriptive error message: "API client is not authorized by the resource owner to access the resource requested."

Example:

curl -X DELETE "https://api.fitbit.com/1/user/8NCR2K/activities/apiSubscriptions/8NCR2K-activities.json" \
 -H "accept: application/json" \
 -H "authorization: Basic <base64-encoded-client-id:client-secret>"

Response:

{ 
  "errors": [ 
    { 
      "errorType": "insufficient_permissions", 
      "message": "API client is not authorized by the resource owner to access the resource requested. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
    }
  ],  
  "success": false
}

In this solved thread, the answer seems to indicate that Fitbit will allow client-level subscription management via a new feature.  When is this feature going to be available?

cc @GordonFitbit 

[GordonFitbit]

Hi John,

I'm suspecting the problem might be related to your access token/refresh tokens getting out of sync with what you have in your database.   If a user revokes consent to your application, we should automatically delete the subscription for you.  I'll send you a private message to see if we can find a solution for you.

Best,

Gordon

[JohnAtPaceline]

Hey Gordon,

Thanks for replying.  We definitely had a problem with refresh tokens getting out of sync due to concurrency mistakes.  We've got that under control.

The problem I'm describing is the inability to unsubscribe users from the webhook.  Users just delete our app, not realizing that this won't unsubscribe our service from the webhook calls.  We have no way to detect when users delete the app.  Often times, their refresh token is already invalid, anyways.  

The result is that we receive thousands of webhook calls every day for fitbit users that don't use our app/service.  This is always going to be a problem unless your API provides a way to unsubscribe users without their refresh tokens.

-- John