Yesterday, we released changes to further bring our error handling into compliance with the OAuth 2.0 RFC. These changes were inadvertently released without a 30 days notice for potential backwards incompatibility. Given that many clients have already updated, we are not reverting the following changes:
The following error types have been updated in the docs (the detailed error messages can be found here😞
- Authorization code invalid or expired has been split into two error types: 1) authorization code invalid and 2) authorization code expired
- Access token invalid or expired has been split into two error types: 1) access token invalid and 2) access token expired
- Refresh token error message now accurately reflects that refresh tokens do not expire
The following error types were already the appropriate error type in the docs, but actual behavior was changed:
- response_type invalid was returning an "invalid_request", and now returns "unsupported_response_type"
- read-only client attempting to update resources was returning "insufficient_scope", and now returns "insufficient_permissions"
- "Basic" misspelled in authorization header was returning "invalid_request", and now returns "invalid_client"
We apologize for this short notice.
—The Fitbit Web API Team
