12-21-2020 07:29 - edited 12-21-2020 07:44
- Mark as New
- Bookmark
- Subscribe
- Permalink
- Report this post

12-21-2020 07:29 - edited 12-21-2020 07:44
- Mark as New
- Bookmark
- Subscribe
- Permalink
- Report this post
I have read through the following thread hoping to find an answer, but it seems from the responses that there is no solution.
https://community.fitbit.com/t5/Web-API-Development/Invalid-or-expired-refresh-tokens/td-p/1048159
I understand that the refresh token is a one time usage thing. If our data retrieval service errors after the api call for whatever reason and fails to save the new refresh token, it sounds like we're then in a very painful place. From the above thread it sounds like there is no way to refresh the token again without the user disconnecting and reauthorising.
Is there any way to refresh a 'used' refresh token without the user having to re-authorise?
12-22-2020 15:49
- Mark as New
- Bookmark
- Subscribe
- Permalink
- Report this post



12-22-2020 15:49
- Mark as New
- Bookmark
- Subscribe
- Permalink
- Report this post
Hi @BrentFit
When using the Authorization Code Grant Flow, you need to store the user's access token and refresh the token upon authorization. When the access token expires after 8 hours, your application should use the refresh token to obtain a new access token and refresh token pair. In order to minimize the user experience, your application will need to store the new access token and refresh token and discard the old refresh token from your database. That way, your application can use the new refresh token to obtain a new pair of tokens when the time comes.
There is no way to reuse an invalid refresh token after it has been used to obtain a new access token and refresh token pair If your application loses the user's refresh token, they'll need to go through the authorization process again in order to obtain a new refresh token from the user.
If you haven't done so already, I recommend review the Authorization Code Grant Flow documentation here: https://dev.fitbit.com/build/reference/web-api/oauth2/#authorization-code-grant-flow
I hope this helps. Let me know if you have any additional questions.

