Client Credentials Grant Flow
The /oauth2/token endpoint can do the following:
- Exchange the authorization code for the initial access token and
refresh token (See
This process is required when using the Authorization Code Grant Flow [with PKCE].
- Obtain a new access token and refresh token when the existing access token has expired (See Refresh Token).
- Initiate the Client Credentials authorization flow (See Client Credentials).
Fitbit follows the OAuth 2.0 Client Credentials flow as specified in RFC 6749. This authorization flow is used with specific Fitbit API endpoints related to business operations. It is not supported by the public Web APIs to retrieve Fitbit user data.
The Client Credentials Grant flow has the following steps:
- The application sends a request to https
://api.fitbit.com/oauth2/token with its client_id and client_secret; and
- Fitbit authenticates your application and issues an access token.
Supported: client_credentialsType: string
Pre-select the desired access token lifetime.
Default: 28800Type: string
Must be set to Basic followed by a space, then the Base64 encoded string of your application's client id and secret concatenated with a colon. For example, the Base64 encoded string, Y2xpZW50X2lkOmNsaWVudCBzZWNyZXQ=, is decoded as "client_id:client secret".Token type:
|accept||optional||The media type of the response content the client is expecting.
|accept-language||optional||The measurement unit system to use for response values. See Localization.|
|accept-locale||optional||The locale to use for response values. See Localization.|
Authorization: Basic <basic_token>
-H "accept: application/json" \
-H "authorization: Basic <basic_token>" \
|access_token||The active access token.|
|expires_in||The time the access token expires in seconds.|
|scope||List of scopes supported by the access token.|
|content-type||The media type of the response content being sent to the client.
|fitbit-rate-limit-limit||The quota number of calls.|
|fitbit-rate-limit-remaining||The number of calls remaining before hitting the rate limit.|
|fitbit-rate-limit-reset||The number of seconds until the rate limit resets.|
Note: The rate limit headers are approximate and asynchronously updated. This means that there may be a minor delay in the decrementing of remaining requests. This could result in your application receiving an unexpected 429 response if you don't track the total number of requests you make yourself.
|HTTP Status Code||HTTP response code. List of codes are found in the Troubleshooting Guide.|
|Status Message||Description of the status code.|
|Response Body||Contains the JSON response to the API call. When errors are returned by the API call, the errorType, fieldName and message text will provide more information to the cause of the failure.|
|200||A successful request.|
|400||The request had bad syntax or was inherently impossible to be satisfied.|
|401||The request requires user authentication.|
Note: For a complete list of response codes, please refer to the Troubleshooting Guide.