problems trying to authorize my web app

[JavierAP]

I am developing a web application that will get the sleep hours of my users.

I am trying to obtain user authorization to obtain the profile and sleep data of my personal account using my web application (Client ID: 22C5CR), until Sunday 14 everything worked fine, I obtained authorization, my application was registered in my profile personal and could obtain the user profile to record the information in my database.

When I made a call to get the dream yesterday it told me that the user's token was expired and I made the call to renew the token (I forgot to record that data because the option was in development) and then I repeated the procedure and it gave me a token error message, after that I cannot authorize my application again, the process seems to work but I do not receive the authorization information, the application authorization is not recorded in my personal FitBit profile and therefore I cannot get my user information.

I have deleted my application from dev.fitbit.com and created it again (Client ID above) but it still does not work, when I run the registration, the Fitbit screen appears to authorize the application, I select the fields and it sends me to me callback but I only receive the CODE = xxxxxx and nothing else, my application is not recorded in my personal profile and I do not get anything when asking for the profile, not even an error JSON.

Thanks for your help.

[JohnFitbit]

Hi @JavierAP,

If you haven't done so already, I recommend going through your application's OAuth 2.0 flow tutorial found within your application's settings at dev.fitbit.com. This will guide you through the process of authorizing your application to access your Fitbit data.

It sounds like you misplaced the refresh token somewhere along the way, which is needed in order to obtain a new access_token when it expires. Can you clarify if the user profile you are trying to obtain a new access_token for belongs to your personal account or another user's?

• If the account you're trying to obtain a new token for belongs to you, I would simply revoke access to your application through https://www.fitbit.com/settings/applications, then go through the authorization flow again to obtain a new access_token and refresh_token. I recommend you use an HTTP Client library of your choice to capture and manage tokens.
• If the account you're trying to obtain a new token for does not belong to you, you'll need to ask the user to go through the authorization process again and store their access_token/refresh_token pair after consent has been obtained.

"I have deleted my application from dev.fitbit.com and created it again (Client ID above) but it still does not work, when I run the registration, the Fitbit screen appears to authorize the application, I select the fields and it sends me to me callback but I only receive the CODE = xxxxxx and nothing else,"

• This is the correct behavior as your application needs to capture the code received in the redirect URI as a parameter after the Fitbit user consents to share their data with your application. The redirect URI you provide during your application setup is where Fitbit will redirect users to after they consent to share data with your application. Your application then uses the code it received for the "Access Token Request" endpoint.

It looks like you might be using Python since this was the label you used. If you would like to see an OAuth 2.0 Python example, you can check out our Community Resources to see how other developer implemented the OAuth 2.0 flow into their environment: https://dev.fitbit.com/build/reference/web-api/community-resources/

I hope this helps. Let me know if you have any additional questions.

[JavierAP]

Hi JohnFitbit, thank you for your answer.

I am using my personal account to do the authorization tests of my application, I do it in a different browser so as not to interfere with my developer account.

I followed the procedures indicated in the tutorial and in fact it was working properly until Tuesday, I could call my personal user's authorization page, select the data I wanted to authorize (all), authorize the application and the app would register in my personal profile and get the authorization tokens.

I was even able to get the sleep data from my personal account, but after an error when refreshing the user token I could no longer receive data from Fitbit and after I disallowed the app into my personal account I can't re-register my app in my personal profile, it just doesn't do anything.

The problem now is that even though I authorize the application, it does not register in my personal profile and I do not receive the authorization tokens, I only receive the CODE and when I run the cURL call to get the tokens I do not even receive an error response, everything is empty.

I am using PHP for my web application since my API will make the request for sleep data when the client requests it by the APP.

I don't know why is not working now, everything happened after I made the mistake refreshing the user token.

Thanks.

[Gordon-C]

Hi @JavierAP 

When authorizing your personal application type, you will only be able to retrieve the data for the application owner.   It's ok to use a second browser window for testing, but make certain you're logged into fitbit.com using the dev.fitbit.com account.   Once the user has authorized the application and the user goes through the authorization process again, the consent webform will not be displayed.   It sounds like receiving the authorization code is correct behavior.   From there, you can use the /oauth/token endpoint to exchange the authorization code for the access token and refresh token.

If you want to see the consent webform again, you have 2 options

1. The application can revoke the access token using the revoke endpoint.
2. In the fitbit.com settings, go to "Applications" and revoke consent for your application.

Gordon

[JavierAP]

Hi @Gordon-C

Thank you for your answer.

I understand that part about the authorization and I was able to authorize my APP before on my personal account and even get my sleep once, then I revoked access to my app and tried again because I made a mistake getting the user token and I wanted to start over again.

After I revoke the consent on my personal account, I'm not able to get it again, I run the process, got the consent web form, select the data I'm going to share and authorize, then I get the authorization code on my callback url but when I try there to get the oauth token I haven't receive any data at all, and going to see my personal profile on fitbit.com->settings->applications, I can't see my app there, so apparently for some reason, even when I authorize my app, it does'nt happens, and I can't get the token and of course I don't have access to my personal data.

I'm doing exactly the same procedure i did before when I was able to authorize my app and get my first sleep data but now is not working, after the callback funcion is called, I can't get the token and the app doesn't appear on my personal profile.

Javier.

[Gordon-C]

I don't see any recent activity on that client ID.   Would you please test the authorization again?

[JavierAP]

Dear @Gordon-C 

I just tried to authorize my app again with my private account, same issue, no token received just the code and the App is not registered on my personal profile.

Thanks.

[Gordon-C]

Hi Javier,

After receiving the code, what are you executing to convert the authorization code into the access and refresh tokens?

Gordon

[JavierAP]

Hi @Gordon-C here is my PHP code on the callback script, ti works before this problem.

$authorization = CLIENT_ID . ":" . CLIENT_SECRET;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https:api.fitbit.com/oauth2/token");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'grant_type' => 'authorization_code',
'code' => $ccode,
'client_id' => CLIENT_ID,
'client_secret' => CLIENT_SECRET,
'redirect_uri' => REDIRECT_URI)));
curl_setopt($ch, CURLOPT_HTTPHEADER,
array('Authorization: Basic ' . base64_encode($authorization), 'Content-Type: application/x-www-form-urlencoded'));
$data = curl_exec($ch);
$response = json_decode($data);
$access_token = $response->access_token;
$refresh_token = $response->refresh_token;

$ccode is que code i've received and when I print the $response variable is empty.

if the $access_token is not empty, this is the next PHP code:

$oauth_profile_header = ["Authorization: Bearer " . $access_token];
$url = "https:api.fitbit.com/1/user/-/profile.json";
$cu = curl_init($url);
curl_setopt($cu, CURLOPT_HTTPHEADER, $oauth_profile_header);
curl_setopt($cu, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($cu, CURLOPT_SSL_VERIFYPEER, false);
$userprofile = curl_exec($cu);
$profile = json_decode($userprofile);
curl_close($cu);

The I run the profile whith a foreach to get the user dataand store that into my database

This was working before.

Thanks.

[Gordon-C · Accepted solution]

I'm not a PHP programmer but is the syntax "https:api.fitbit.com/oauth2/token" correct for PHP, or should it be "https://api.fitbit.com/oauth2/token"?

[JavierAP]

Hi @Gordon-C ,

I just can't believe how blocked my brain was to not see that, it's what happens when you work on multiple projects at the same time, not recommended.

Thank you very much for opening my eyes and sorry for the inconvenience.

Javier.

[Gordon-C]

If the token endpoint is wrong, check the profile endpoint in your code too.   It has the same problem.

[Gordon-C]

No worries.   Glad I could help.