Unable to use Implicit Grant Flow on newly registered app

[glenngr]

Hi.

I just registered a new application on dev.fitbit.com

I then used the OAuth 2.0 tutorial to generate an authorization url using the Implicit Grant Flow.

When I try to click the URL, I get an error message:

Developer information: unauthorized_client - The client is not authorized to request an access token using this method.

 The Authorization Code Flow works, but not Implicit Grant Flow.

I am integrating the Fitbit Web Api into a frontend javascript project without a backend, so I should be using Implicit Grant Flow. Why is it not working? I also have an old application registered, it does not work there either.

[Gordon-C]

Hi @glenngr 

I believe you're getting this error because you've set the application type = "server" and trying to use the implicit grant flow in the OAuth Tutorial.  When using implicit grant flow, try setting the application type = "client"

Gordon

[glenngr]

Hi, and thanks for your reply. App type is browser.

Should I be using Authorization Code Grant Flow with PKCE instead?

This is a browser-only app, no backend.

[Gordon-C]

Hi @glenngr 

Implicit Grant Flow is best for web applications that do not have a server component to the architecture.  See RFC6749 1.3.2.  So, the application type = "client" in the dev.fitbit.com application configuration.

Gordon