oath2 token refresh javascript

[clockwork_robot]

I am trying to get oauth2 working properly so I can poll sleep logs.  The initial auth portion works fine, but when the access token expires, I need to be able to refresh it.  I read the oath example and tried to follow it.  I also found a bunch of people having seemingly similar problems, but none of their solutions fixed my issue.  What am i doing wrong here?  Thanks in advance.

const headers = {
    'Authorization': `Basic <Base64encoded_string>`,
    'Content-Type': 'application/x-www-form-urlencoded',
};
const body = JSON.stringify({
    'grant_type': 'refresh_token',
    'refresh_token': `${settings['oauth'].refresh_token}`,
});

fetch('https://api.fitbit.com/oauth2/token', {
    method: 'POST',
    headers,
    body,
}).then(function (response) {
    // do stuff with the response

};

I verified that `settings['oauth'].refresh_token` is valid.

[clockwork_robot]

Sorry, I forgot to put the actual error I'm getting... here it is:

{

    "errors":[

        {

            "errorType":"invalid_request",

            "message":"Missing 'grant_type' parameter value. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."

        }

    ],

    "success":false

}

[JohnFitbit]

Hi @clockwork_robot,

Not sure why you are seeing this error since your code looks right to me. Maybe I'll find something in our logs that will determine the issue. Can you please PM me your Client ID and the refresh token you're seeing this error on?

Hope to hear from you soon!

[clockwork_robot]

I sent a PM, did you get it?

[clockwork_robot]

For anyone who has this problem in the future, I figured part of the issue out.  The body needs to be in query string format like this:

body=`grant_type=refresh_token&refresh_token=${settings['oauth'].refresh_token}`

Before I was doing it like this:

body =  JSON.stringify({
    grant_type: 'refresh_token',
    refresh_token: `${settings['oauth'].refresh_token}`,
});

I am still not sure how I can get the client ID and secret to build the base64 encoded authorization part of the header, currently I just have it hard coded... which seems like a bad idea.  If you know how to grab that from the app running on the watch, please let me know.  Thanks

[clockwork_robot · Accepted solution]

The other part of the issue is that I was only storing and using the returned access and refresh tokens locally.  That meant that the settings in the companion part of the app would feed old tokens if I restarted the app.  That refresh token would then by invalid, causing me to have to re-login each time I started the app.  By pushing the updated tokens back to the settings system, now I can restart the app and have it pick back up correctly.

[JohnFitbit]

@clockwork_robot Thanks for sharing the details with me in PM and I'm glad you were able to figure it out!

In the meantime, please check out our Common Solutions guide in case you come across other Refresh Token issues in the future. We're always updating this page, so feel free to refer to it in case you have any questions.

I hope this helps.