Why authorization fail even after getting tokens?

[brettr]

Users click a link to authorization our app at fitbit.com.  Once they return, I'm able to poll their information via the API.  At this point, everything seems to have authorized correctly.  I store the users tokens here as well.

However, when I try to later access this users' (or now any users') info via the API using their stored tokens and our client tokens, I get a 401 unauthorized error.  Do you have some idea why we are granted access only initially?

[SunsetRunner]

Are you sending the user through the OAuth flow again at any point? There are two ways that the token is invalidated:

1. You send the user through the OAuth flow again and the old token is invalidated and a new token is issued

2. The user revokes your application

[brettr]

It isn't #2 since this is a test user.

Can you describe what exactly you mean by sending the user through the OAuth flow again?  How do I detect if that is happening?  Far as I know, it isn't.

When you say token, which do you mean specifically?  There are several involved.

[SunsetRunner]

When I said token in the previous post, I meant the user's oauth token and oauth token secret.

Basically if you are doing a request_token call, sending the user to the fitbit.com authorize page this will trigger a token re-issue. As long as you are updating the stored user token every time you get an OAuth callback to your app, this should not be an issue.

Private message me your consumer key, the token you have stored, and the user's email and I can try and see if their token was re-issued.