invalid_grant error

[badcb]

Hi!

I keep getting a console error for invalid_grant. It says my authorization code is invalid, but it isn't expiring and it seems to be a valid code. Can you please help?

[Gordon-C]

Hi @badcb 

I have a few questions for you:

1. At https://dev.fitbit.com/apps, what is the application type for your client ID?
2. Please provide your complete authorization URL so I can test your consent flow
3. What syntax are you using to convert the authorization code to an access token and refresh token.   Please redact the authorization code and code_verifier values.

[badcb]

Thanks for getting back to me!

application type: Browser

authorization URL: 'https://www.fitbit.com/oauth2/authorize?response_type=code&client_id=${clientId}&redirect_uri=${enco...

syntax to convert authorization code to access token: 

onst authOptions = {
url: 'https://api.fitbit.com/oauth2/token',

method: 'POST',
headers: {
'Authorization': 'Basic ' + Buffer.from(clientId + ':' + clientSecret).toString('base64'),
'Content-Type': 'application/x-www-form-urlencoded'
},

[Gordon-C]

Did you provide the body parameters in your https://api.fitbit.com/oauth2/token endpoint call?

[badcb]

Yes, I do that immediately below the code I pasted above: 

form: {

code: code,

grant_type: 'authorization_code',

redirect_uri: redirectUri,

code_verifier: codeVerifier

}

[Gordon-C]

1. When you extract the authorization code from the redirect URL, are you getting the text as described in step 3 of this part of the documentation: https://dev.fitbit.com/build/reference/web-api/developer-guide/authorization/#Authorization-Code-Gra...

2. Have you verified that you are getting a new code for each authorization attempt, even for the same user?

[badcb]

I am getting a new code everytime for each authorization attempt, but in the callback URL, my authorization codes are longer than the 21 character code shown in step #3 of https://dev.fitbit.com/build/reference/web-api/developer-guide/authorization/#Authorization-Code-Gra....  The codes in my URL's are 40 characters long  

[Gordon-C]

The 40 character code you're getting is correct.  We likely truncated the code to 21 characters since it is public documentation.

I'm going to email you directly to get some more information.