Use Case: show others my own data

[Alessandro69]

Please, imagine that I'm a VIP and, through my app, I want to share my data with my fans (no fitbit users). Then my app does not need to ask them to authenticate because they have nothing to authorize since I'm the fitbit account owner. 

In this case, what is the best practice to access the fitbit api by a webservice or directly through the app?

Thanks 

[JeremiahFitbit]

Hi @Alessandro69,

You would create a web server app that you would authenticate with. Your app would download your data from Fitbit and then your app could display your data wherever you wish.

[Alessandro69]

Thanks @JeremiahFitbit, my doubt was about the authentication method. It seems that Fitbit API does not support 2-legged that would be the perfect way for my case. Then, considering what is the suggested path to integrate my system in order to periodically fetch data by the fitbit API? Is it Authorization Code Grant and refreshing the token every time my server connect to Fitbit?

[Alessandro69]

With 2-legged oAuth I mean providing from the beginning username and password (User Credentials grant type)

[JeremiahFitbit]

---

@Alessandro69 wrote:

With 2-legged oAuth I mean providing from the beginning username and password (User Credentials grant type)

---

We don't offer this option, as there are enormous security implications with allowing third-party apps to handle user credentials and Fitbit offers methods of authentication (Facebook, Google, potentially others in the future) besides username/password.

[JeremiahFitbit · Accepted solution]

---

@Alessandro69 wrote:

Thanks @JeremiahFitbit, my doubt was about the authentication method. It seems that Fitbit API does not support 2-legged that would be the perfect way for my case. Then, considering what is the suggested path to integrate my system in order to periodically fetch data by the fitbit API? Is it Authorization Code Grant and refreshing the token every time my server connect to Fitbit?

---

I would recommend the Authorization Code Grant flow. Your web server application would get an access token and a refresh token. It would need to refresh the access token everytime the access token expires (currently 1 hour). As long as you continuously store the refresh token with each access token refresh, the user would not ever need to reauthorize your application.