What would constitute embedding the authorization page for react native app

[dever_node1]

Upon reviewing the Accessing the FitBit API, documentation, I noticed there is a section that warns against embedding the authorization page.  I am building a mobile app that will allow users to view their fitbit data in a graphical layout.  I want to use the subscription api to get notifications as data becomes available.  I am having a really difficult time finding examples outlining how the OAuth 2.0 process flow should occur when using a mobile app.  I found the following article outlining the process for authenticating to dropbox, Oauth 2 with React Native.

In this article it seems to recommend using the following code to open authentication for dropbox:

function dropboxOauth (app_key) {
  LinkingIOS.openURL([
    ‘https://www.dropbox.com/1/oauth2/authorize',
    ‘?response_type=token’,
    ‘&client_id=’ + app_key,
    ‘&redirect_uri=oauth2example://foo’
  ].join(‘’))
}

Would this constitute embedding the authorization page or would this be acceptable?  Also, if I use a similar approach for fitbit oauth 2.0, how secure would that be if I have to add the app_key to the url string for fitbit?

[Gordon-C]

Hi @dever_node1,

The OAuth 2.0 flow the users will follow is your application will call the OAuth authorize endpoint which redirects the user to an external Fitbit web page listing the scopes/data to share with your application.  The user will select the scopes/data they want to share.  When the user saves this information, the user should be redirected back to your application using the redirect_uri/callback URL provided by you.   

We have a tool that walks you through the OAuth 2.0 process.  The link to tool is here: https://dev.fitbit.com/apps/oauthinteractivetutorial.  You can also access it from within dev.fitbit.com and we will fill in most of the fields for you based on your application configuration

If it helps, I've also found a Swift example someone wrote, https://github.com/Stasonis/fitbit-api-example-swift.