unauthorized_client - The client is not authorized

[JeremyDeveloper]

Hello,
I'm using Xamarin iOS framework, I'm opening a browser(not a webview) in the application, so that I can authorize. After inserting my username and password and clicking log in, I'm forwarded to a page which says: "The app you're trying to connect did not provide valid information to Fitbit. Please report this issue to them.
Developer information: unauthorized_client - The client is not authorized to request an access token using this method"
When I also tried doing the same from Xamarin Andoird, I was able to authorize myself but when making a request for data(from fitbit servers) I received an exception saying : error 401 client not authorized.
Therefore it seems like it's coming from the same root which I'm trying to understand why

[AndrewFitbit]

@JeremyDeveloper Take a look at this post related to the unauthorized_client error and see if that helps. 

[JeremyDeveloper]

Yes I've seen your post previously and tried to do what he says, but still no answer.

[JeremiahFitbit]

What is the URL in the browser window that you receive this error on?

[JeremyDeveloper]

The URL I receive in the browser :
https://www.fitbit.com/oauth2/authorize?response_type=token&client_id=22942C&redirect_uri=http%3A%2F...

In fact I took the url from the api examples :

Implicit Grant Flow:

https://www.fitbit.com/oauth2/authorize?response_type=token&client_id=22942C&redirect_uri=http%3A%2F...

And I've changed the example to kimaia, therefore I'm not sure if I need to change anything else, and how to fill it right if so

[AndrewFitbit]

@JeremyDeveloper You need to use your own client_id from an app you registered at: https://dev.fitbit.com/apps/new

Your redirect_uri also has to match your "callback url" in your app settings.

[JeremyDeveloper]

I've replaced the client-id, now I'm receiving the following: 
invalid_request - Invalid redirect uri parameter value.
As you said I need to change the redirect_call back parameter in the url but I don't exactly know which callback url I'm supposed to write and I don't know how to write. At the moment my redirect call back url is "http://www.kimaia.com/" I would be more than glad if you could just type the url with the redirect callback.
thanks!

[JeremiahFitbit · Accepted solution]

The value of redirect_uri (after being URI decoded) must be the exact text string you enter into your app settings on https://dev.fitbit.com/apps .

The value of redirect_uri (and all of the URL parameters) in the authorization page URL must be URI encoded in order for the browser to not confuse what is a value and what is part of the actual URL for the page being requested. This is an Internet standard.

So http://www.kimaia.com/ becomes http%3A%2F%2Fwww.kimaia.com%2F when represented in the authorization page URL.

[JeremyDeveloper]

I've tried to replace the url, still it shows me the same error.
But when I'm trying to use this link on a clear browser it works : redirect_uri=https%3A%2F%2Fwww.kimaia.com%2%2Fapp%2Fpatienthomepage.fitbitconnect%3AcompleteAuthoriz...

but when trying to use this it doesn't work :
redirect_uri=http%3A%2F%2Fwww.kimaia.com%2F%2Ffitbit_auth&scope=activity%20nutrition%20heartrate%20l...

Edit:

I've managed to get the login page if I write "redirect_uri=http%3A%2F%2Fwww.kimaia.com%2%2F" Notice the %2 is incomplete
But when using it in code, it gets an error because no such uri can be created.
What should I do?

[AndrewFitbit · Accepted solution]

@JeremyDeveloper In your app settings of your registered app, your callback url should be this:

Your authorization url should then look like this:

https://www.fitbit.com/oauth2/authorize?response_type=token&client_id=YOURCLIENTID&redirect_uri=http%3A%2F%2Fwww.kimaia.com%2F&scope=activity%20heartrate%20location%20nutrition%20profile%20settings%20sleep%20social%20weight&expires_in=604800

Replace "YOURCLIENTID" with your own client ID.

---

JeremyDeveloper wrote:

I've managed to get the login page if I write "redirect_uri=http%3A%2F%2Fwww.kimaia.com%2%2F" Notice the %2 is incomplete

---

@JeremyDeveloper "%2%2F" after the ".com" is not a thing, that's why you get an error. You only need "%2F" at the end, which decodes to a forward slash '/'.

Hope that helps. 

[JeremyDeveloper]

Thank you very much Andrew and Jeremiah. Although I've successed now to log in, I'm redirected to the kimaia website(as requested), is there a way to go back to my app and receive the registered account object?
I know it's not part of the fitbit issues, but if you could help me with that it could really help me

[JeremiahFitbit]

If you want to redirect to your native app, you'll need to register a custom URI / protocol handler for your app. Your redirect URI would become something like myapp://auth/fitbit and then Android/iOS/Windows would see "myapp://" and know to open that URL in your app. This is a little complicated and beyond the support we can help you with, but you should be able to find plenty of documentation about custom app protocols for each platform you need to support.

[JeremyDeveloper]

Thanks!

@JeremiahFitbit 
I've succeeded to go back to my app, but now I need to get the account object and I don't know where to get him from (I'm doing this not from a webview - because the API said no embeded webviews), so now I don't know how to connec the successful authorization with the auth-object
Any ideas?

	@IBAction func signInSafari(_ sender: UIButton?) {
		if oauth2.isAuthorizing {
			oauth2.abortAuthorization()
			return
		}
		
		sender?.setTitle("Authorizing...", for: UIControlState.normal)
	
		oauth2.authConfig.authorizeEmbedded = false		// the default
		let loader = OAuth2DataLoader(oauth2: oauth2)
		self.loader = loader
		
		loader.perform(request: userDataRequest) { response in
			do {
				let json = try response.responseJSON()
				self.didGetUserdata(dict: json, loader: loader)
			}
			catch let error {
				self.didCancelOrFail(error)
			}
		}
	}

I've found this on the web, but I can't produce the steps for me to do in my Xamarin iOS

[ayushlion]

Hello @JeremiahFitbit , @AndrewFitbit actually when I am sending my authorization URL to a Fitbit user to authorize my app, after check listing the required scopes and "ALLOW" it so that I can get the auth code which is required for getting the access token and refresh token, the message being displayed as follows:
"The app you're trying to connect did not provide valid information to Fitbit. Please report this issue to them.
Developer information: unauthorized_client - The client is not authorized to request an access token using this method"

My Fitbit authorization URL sent to the user for authorization was :
 https://www.fitbit.com/oauth2/authorize?response_type=code&client_id=23RVVQ&scope=activity+cardio_fi...

This URL is being generated automatically on the Fitbit O Auth 2.0 Tutorial page when I entered my client id and generated other securities of PKCE[code verifier and code challenge].

Please help me dealing with it.
Thanks.

[ayushlion]

Actually the message was:
"The app you're trying to connect did not provide valid information to Fitbit. Please report this issue to them.
Developer information: unauthorized_client - A "Personal" application is only authorized to request access token from the owner of the application."

[ayushlion]

I have made changes in Application Settings after seeing this line 'A "Personal" application is only authorized to request access token from the owner of the application.' I've changed O Auth 2.0 Type from 'Personal' to 'Client' and then send the authorization URL to the Fitbit user.

Now this time the ALLOW page came up but after allowing it redirects to the page which states that "Safari can't open the page because it couldn't connect to the server."

Now what to do now?

[JohnFitbit]

Hi @ayushlion,

Welcome to the forums!

When you mentioned sending the authorization URL to the Fitbit user, can you tell me if that user can access your IP address? The reason I ask is because when I checked your application settings, the redirect URI you're using is localhost. Unless you're exposing your localhost IP externally, the end-user will not be redirected back to your application after consent, thus ending in a failed authorization request. I recommend changing your redirect URL to a publicly accessible URL and try your request again.

[ayushlion]

Thanks @JohnFitbit for answering..

Error resolved..
I have just converted the http://localhost redirect URL into 'https' URL using "ngrok" application to make it publicly accessible over the internet.

[ayushlion]

🤗

[JohnFitbit]

Glad to hear that you got it working @ayushlion!