User Authorization & Scopes

[Jeff_New_Ocean]

When a user authorizes their Fitbit on the authorization page, they are given the opportunity to select (or not) checkboxes for various scopes. Once they do that and submit, is there anywhere in the Fitbit app or device that the user can modify those selections? Example: If the user later decides they don't want to share "sleep" data.

• If so, do we get any notification of that activity?
• If not, I assume that means the user would have to disconnect and reauthorize for our application to see the selections again.

Thanks,
Jeff

[GordonFitbit · Accepted solution]

Hi @Jeff_New_Ocean 

The only way for a user to change the scopes they authorized is to go through the authorization flow again.   You can have the user revoke consent and reauthorize your application, but I don't think that is necessary.   My recommendation is to have a button or link in your application that states something like "Change scopes".   Then send the user through the authorization process again making certain to specify the parameter "prompt=consent".  See Authorize URL.  This should present the scopes page to the user so they can make adjustments.

[Jeff_New_Ocean]

Thanks @GordonFitbit that was super fast!

We currently do have the app set up so that if the user is "connected" they can disconnect or refresh.

I just was confirming if there was a hole where they might be able to change authorized scopes on your end where we would be unaware (and we would get authorization errors). But it sounds like there is not!

Thanks,
Jeff