invalid_grant error when requesting for oauth2 token

[youbs]

Hello!

I was able to access the access_token last week from from since yesterday even with new authorisation code I still keep getting 

{
"errors": [
{
"errorType": "invalid_grant",
"message": "Authorization code invalid: 3D68e6124cc72f5d42f4b8ec98a358c642cfc7f4b0 Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
}
],
"success": false
}

here are some more details in order to check on your side:

- client_id: 238JKX

- code_verifier: 01234567890123456789012345678901234567890123456789

- code_challenge: -4cf-Mzo_qg9-uq0F4QwWhRh4AjcAqNx7SbYVsdmyQM

using same codes from the example shared here https://dev.fitbit.com/build/reference/web-api/developer-guide/authorization/

I am still able to get new authorisation code with this request

https://www.fitbit.com/oauth2/authorize?client_id=238JKX&response_type=code
&code_challenge=-4cf-Mzo_qg9-uq0F4QwWhRh4AjcAqNx7SbYVsdmyQM&code_challenge_method=S256
&scope=activity%20heartrate%20nutrition%20oxygen_saturation
%20respiratory_rate%20settings%20sleep%20temperature%20weight

but even with new code I keep getting invalid_grant error, can you please help me to understand the reason?

[Gordon-C]

Hi @youbs 

I recommend you change your code verifier and challenge since this is a public forum.   

It sounds like there is some confusion how the authorization process works.   Once you've used the authorization code to obtain the access token and refresh token, that authorization code becomes invalid.   When the access token expires after 8 hours, you'll use the refresh token to obtain a new access token and refresh token pair for that user.  You'll continue with this process of exchanging the refresh token with a new access token / refresh token pair until you or your participants revokes consent.

See Using Tokens Effectively for more details

[youbs]

Hell @Gordon-C thanks for replying!

Yes I understand that and that's the exact same way I was trying to get the access token again. I was able to access it last week without any issues but for some unknown reason it was not working yesterday at all. Then I followed the oauth2 tutorial page and managed to get token for my new application with personal token type. I exactly don't have reason but that was the behaviour observed yesterday

Thanks!