refresh token invalid when using 2 or more devices

[myfitnesscomp]

Hi

This is the scenario. A user uses 2 or more mobile devices to get data from Fitbit server. User authenticates and the refresh token is stored locally on the phone. User does the same for another mobile device using the same Fitbit credentials (same account). After a couple of hours the user syncs the data on one device and needs to get a new access token. The app uses the stored refresh token to get the access token. However I get now the error message "Refresh token invalid:....." 

This is logical since the other app used a different refresh_token which is stored on the Fitbit server.

So the question is whether it is possible to renew the access token on different devices WITHOUT the user to explicitly have to login/grant permission?

Thanks Peter

[JeremiahFitbit · Accepted solution]

A mobile app is considered a "public client" in OAuth 2.0 terminology, because it is code that executes on a computer that you (as the app developer) don't control. This means that your app cannot keep your OAuth 2.0 client secret truly a secret. Use of the Authorization Code Flow and Refresh Token Flow requires your client secret, so these flows are not available to them.

Your options are to use the Implicit Grant Flow, which is designed for public clients, or to use the Authorization Code Flow with a web server app and have the Android app securely retrieve the current access token from your web server app.