Getting Invalid signature error while invoking FITBIT rest API

Question

I have registered in FITBIT. I am making a request to fitbit api(POST /oauth/request_token) with consumer key. I have referred https://wiki.fitbit.com/display/API/OAuth+Authentication+in+the+Fitbit+API

My request is: POST /request_token HTTP/1.1 Host: oauth Authorization: OAuth realm="https:/api.fitbit.com/oauth/request_token",oauth_consumer_key="XXXXXXXXXXXX",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1399958922",oauth_nonce="H8xxW0",oauth_version="1.0",oauth_signature="80M1tag6%2FYk2JV%2FQdQ%2BucxxDrLA%3D" Cache-Control: no-cache

I am getting invalid signature error with below json object:

{
    "errors": [
        {
            "errorType": "oauth",
            "fieldName": "oauth_signature",
            "message": "Invalid signature: 80M1tag6/Yk2JV/QdQ+ucxxDrLA="
        }
    ],
    "success": false }

We have Consumer Key and Consumer Secret Key. Don't have Token Secret at this stage. please give me a solution to get this API working.

Thanks, Kalyan

I am using google chrome addon postman rest console to invoke this rest API. I have added 'oauth_callback' parameter as 'example.fitbit.com/app/completeAuthorization'. Actually What callback url should I provide and what callback url needs to be configure in my FITBIT app. I am unable to understand how this callback url works for this REST API. — Kalyan
Your callback url is in the application you are writing. It will be called by Fitbit once authenticated and provide the access token details required to call the other rest resources — WestDiscGolf

sallamander sallamander · Accepted Answer · 2015-03-17T14:06:53

Like WestDiscGolf mentioned, you need to make sure that your callback URL matches the callback URL in the application you are writing. Usually when you sign up for a developer account to access API's, they ask for a callback URL, and the callback URL has to match what you put in when you request an access token.

If you're getting an invalid signature error, though, then the callback URL probably isn't the issue. You need to make sure that the signature matches exactly what they specify in the API documentation. Signatures can be tricky, and there are a number of libraries that are available to help with that. I use Java primarily, and for Java the Scribe library is great (https://github.com/fernandezpablo85/scribe-java).

Getting Invalid signature error while invoking FITBIT rest API

1 Answers