access_token invalid

[jamestombs]

The first upload worked fine, subsequent attempts have failed with the following JSON return:

{"message":"Authorization Error","errors":[{"resource":"Athlete","field":"access_token","code":"invalid"}]}

The .stravauprc file has all 3 bits of information.

[kwaaak]

http://yizeng.me/2017/01/11/get-a-strava-api-access-token-with-write-permission/

[kimble4]

I think I've got it to work with the API changes by doing the following:

First, we need to change the scope in the authroize URL from "write" to "activity:write":

# Get authorization code
if [ "$STRAVAUP_CODE" = "" ]; then
    echo "Please open the following URL in a browser"
    echo -n "https://www.strava.com/oauth/authorize?client_id="
    echo -n "$STRAVAUP_CLIENT_ID"
    echo "&response_type=code&redirect_uri=http://localhost/index.php&approval_prompt=force&scope=activity:write"
    echo "Select 'Authorize' which will lead to a redirect into a localhost address. Copy the authorization"
    echo "code into .stravauprc"
    echo "  STRAVAUP_CODE = [insert your own]"
    exit 1
fi

Then replace the "Get auth token" section with the following:

# If needed, get refresh token
if [ "$STRAVAUP_REFRESH_TOKEN" = "" ]; then
        echo "Exchanging authorization token for refresh token..."
        STRAVAUP_REFRESH_TOKEN=$(curl -s -X POST https://www.strava.com/oauth/token -F client_id="$STRAVAUP_CLIENT_ID" -F client_secret="$STRAVAUP_CLIENT_SECRET" -F code="$STRAVAUP_CODE" -F grant_type=authorization_code | cut -d':' -f5 | cut -d',' -f1 | sed -e 's/[^a-z0-9]//g')
        echo "STRAVAUP_REFRESH_TOKEN=$STRAVAUP_REFRESH_TOKEN" >> ${HOME}/.stravauprc
fi

# Get auth token
if [ "$TOKEN" = "" ]; then
    echo "Getting auth token..."
    TOKEN=$(curl -s -X POST https://www.strava.com/oauth/token -F client_id="$STRAVAUP_CLIENT_ID" -F client_secret="$STRAVAUP_CLIENT_SECRET" -F grant_type=refresh_token -F refresh_token="$STRAVAUP_REFRESH_TOKEN" | grep access_token | cut -d':' -f3 | cut -d',' -f1 | sed -e 's/[^a-z0-9]//g')
fi

We first use the authorisation code to obtain a refresh token, which we save in the config file. Then use the refresh token to obtain a (quickly-expiring) auth token.

[dspinellis]

This is very useful; thank you for posting it! The first step results in a connection timeout unless a process is listening on the local host. Here are two simple solutions to obtain the code value.

• Run locally the command nc -l 80 before making the request. This will produce output such as GET /index.php?state=&code=abbb44b5ba54b4494756937374&scope=read,activity:write HTTP/1.1. The code value is the one needed.
• Run the browser's network monitor (Ctrl-Shift-K on Firefox). The last POST request to localhost will have the needed code in it.