Using the web API with a non-public-accessible callback and subscriber URL

[gsgrammar]

Hi,

I'm trying to implement a dashboard at work for my colleagues and I to track our fitbit usage.  There's about four of us in the IT team, and we want to display a running total of our steps - so we're looking at the web API as the best way to get that information.

The endpoint which we want to display the data on is our internal dashboard, which is only available on our intranet; for various security reasons I don't want to punch it through our firewall.

Every time I try to make an oAuth call I get:

The app you're trying to connect did not provide valid information to Fitbit. Please report this issue to them.

Developer information: invalid_request - Invalid redirect_uri parameter value

My callback/redirect url is http://dashboard.[external.domain]:8081/ajax/fitbit.php.  I'm using the oauth2-fitbit php library but I've tried several with no change.

I tried adding a subscriber to my web app, but of course I can't verify the subscriber because it's not publically available.  EDIT: Okay, so I've read into subscriptions a bit more and that last sentence made no sense in context; if the URL isn't publically available the subscription system can't feed data back.  The original question stands, though - can I poll for data without an externally-available endpoint?

Is there any way around this?  Am I using the right technologies or should I try something else?

Thanks,

Matt

[AndrewFitbit]

@gsgrammar The callback url you're using has to match exactly with what's in your app settings.