Upgrading to OAuth 2.0 tokens: Where to get them?

[Xtian]

I'm trying to upgrade my current OAuth 1.0a access tokens to OAuth 2.0, following the instructions here.

There it says:

"To do this, make an OAuth 2.0 request for each user similar to the refresh token request. The refresh_token must be set to the user's OAuth 1.0a access token and access token secret concatenated with a colon."

Since it's similar to the refresh token request, my first header should be:

Base64(Client_ID:Client_Secret)

However, I'm having problems figuring out what to send in the body. My request looks something like:

curl -X POST -H "Authorization: Basic Base64(Client_ID:Client_Secret)" -H "Content-Type: application/x-www-form-urlencoded" --data "grant_type=refresh_token&refresh_token=XXXX:YYYY" https://api.fitbit.com/oauth2/token

When I run this I get this error:

{"errors":[{"errorType":"invalid_grant","message":"Refresh token invalid or expired: XXXX:YYYY. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}

I believe this is because what I'm sending in the refresh_token parameter is Client (Consumer) Key:Client (Consumer) Secret, but what I should send is access_token:access_token_secret.

So, where do I find the access token and access token secret? In the Manage my apps menu I can't find those.

Or, in any case, what am I doing wrong?

Thanks!

[JeremiahFitbit]

---

@Xtian wrote:

My request looks something like:

curl -X POST -H "Authorization: Basic Base64(Client_ID:Client_Secret)" -H "Content-Type: application/x-www-form-urlencoded" --data "grant_type=refresh_token&refresh_token=XXXX:YYYY" https://api.fitbit.com/oauth2/token

---

Are you sending the actual text "Base64(Client_ID:Client_Secret)"? If so, that's your problem. You need to actually Base 64 encode your client id and client secret concatenated with a colon and provide that valute in the Authorization header.

[JeremiahFitbit]

---

@Xtian wrote:

I believe this is because what I'm sending in the refresh_token parameter is Client (Consumer) Key:Client (Consumer) Secret, but what I should send is access_token:access_token_secret.

So, where do I find the access token and access token secret? In the Manage my apps menu I can't find those.

---

The refresh_token parameter should be the OAuth 1.0a access token and access token secret for the user whose authorization you are upgrading. You won't find that in the Manage My Apps menu. These values can only be obtained by going through the OAuth 1.0a authorization process.