get a permanent access token

[vinesh]

I am trying to build an application for a client which should just fetch data from fitbit from him only.

I have created an app on fitbit through that I have client key and secret. 

1) is it possible to access his steps with his user id OR email registered with fitbit, without following the oauth flow and without access token.

2) if 1 is not possible then is it possible to generate access token once and use it untill the user revokes permission to the fitbit app.

3) what will you recommand to implement this with NodeJS back end.

4) Do fitbit has webhooks that call my server's rest api when event happens?

Thanks

[JeremiahFitbit]

1. No. An application must obtain consent from the user using OAuth 2.0.
2. Access tokens obtained using the OAuth 2.0 Authorization Code Grant Flow contain a refresh token. The refresh process can be done infinitely, assuming the user does not revoke access and your application always properly stores the newly issued refresh token.
3. Fitbit has a standard OAuth 2.0 implementation. Any standard-conforming OAuth 2.0 client should work.
4. Yes. See the Subscriptions API.