{"action":"created","issue":{"url":"https://api.github.com/repos/aarondcoleman/Fitbit.NET/issues/46","labels_url":"https://api.github.com/repos/aarondcoleman/Fitbit.NET/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/aarondcoleman/Fitbit.NET/issues/46/comments","events_url":"https://api.github.com/repos/aarondcoleman/Fitbit.NET/issues/46/events","html_url":"https://github.com/aarondcoleman/Fitbit.NET/issues/46","id":69915083,"number":46,"title":"Concurrent OAuth 1.0a and OAuth 2.0 support in FitbitClient.cs","user":{"login":"aarondcoleman","id":161033,"avatar_url":"https://avatars.githubusercontent.com/u/161033?v=3","gravatar_id":"","url":"https://api.github.com/users/aarondcoleman","html_url":"https://github.com/aarondcoleman","followers_url":"https://api.github.com/users/aarondcoleman/followers","following_url":"https://api.github.com/users/aarondcoleman/following{/other_user}","gists_url":"https://api.github.com/users/aarondcoleman/gists{/gist_id}","starred_url":"https://api.github.com/users/aarondcoleman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aarondcoleman/subscriptions","organizations_url":"https://api.github.com/users/aarondcoleman/orgs","repos_url":"https://api.github.com/users/aarondcoleman/repos","events_url":"https://api.github.com/users/aarondcoleman/events{/privacy}","received_events_url":"https://api.github.com/users/aarondcoleman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":14,"created_at":"2015-04-21T18:15:44Z","updated_at":"2015-05-01T19:46:19Z","closed_at":null,"body":"OK everyone -- let's plan for something we don't actually have our hands on yet but is imminent: The migration to OAuth 2.0. \r\n\r\nFrom what I understand from Fitbit's plans:\r\n* OAuth 1.0a will continue to work for previous endpoints until a future sunset date\r\n* A Fitbit API endpoint will be established that allows us to exchange OAuth 1.0a tokens for OAuth 2.0 ones\r\n* New endpoints (like heart rate) will only be accessible via OAuth 2.0\r\n\r\nIn order to assist people who are going to slowly migrate their application over I'd like to keep the following guiding principles in mind for this wrapper library:\r\n* Breaking changes, i.e. changed data params or returns **should** break on compilation time. This gives the devs a chance to really go through and address the changes and be deliberate.\r\n* Old endpoints that will eventually be sunset should be marked [Obsolete] so at least in the IDE they know it's time to start thinking about it.\r\n* We should try to keep as close to the metal of the new HttpClient. \r\n* The old Fitbit.NET client library (which depends on XML and RestSharp) should be able to be instantiated and used in memory alongside the new one so folks can move from one to the other.\r\n\r\nI think Adam and I have hit a lot of these already so far in this branch.\r\n\r\nIn terms of OAuth 2.0 we have 2 options (or more, seeking input):\r\n1. Modify the FitbitClient constructor to take an authorization class interface that encapsulates the  functionality of adding credentials to the HttpClient header. \r\n2. Create different FitbitClient constructors, one that uses OAuth 1.0a and one OAuth 2.0 and has different parameter lists and sets the appropriate header type.\r\n\r\nFor 1. I'm thinking something like:\r\n\r\n```csharp\r\npublic class OAuth2Authorization : IAuthorization\r\n{\r\n    public override HttpClient AddAuthorizationHeader(HttpClient existingHttpClient, ....)\r\n    {\r\n        //adds in the auth header\r\n    }\r\n}\r\n```\r\n\r\nOR for 2.\r\n\r\n```csharp\r\npublic FitbitClient(string consumerKey, string consumerSecret, string accessToken, string accessSecret) : this(consumerKey, consumerSecret, accessToken, accessSecret, httpClient: null)\r\n{\r\n    // this one calls the private constructor with the params needed for OAuth 1.0A\r\n}\r\n\r\npublic FitbitClient(string consumerKey, string consumerSecret, string bearerToken) : this(consumerKey, consumerSecret, bearerToken, httpClient: null)\r\n{\r\n    // this one calls the private constructor with the params needed for OAuth 2.0 (one less param)\r\n}\r\n```\r\n\r\nAlso, this is how simple it should be to add the Authorization component to an HttpClient for OAuth 2.0, but again, I haven't seen the Fitbit implementation yet:\r\n\r\n```csharp\r\n\r\n//added helper code for OAuth 2.0 header setting\r\nprivate void SetHttpClientAuthorizationBearerToken(string token)\r\n{\r\n    AuthenticationHeaderValue authenticationHeaderValue = new AuthenticationHeaderValue(\"Bearer\", token);\r\n    this.HttpClient.DefaultRequestHeaders.Authorization = authenticationHeaderValue;\r\n}\r\n```\r\n\r\nSeeking input in comments below. Examples of how this was handled elsewhere?\r\n\r\n--Aaron"},"comment":{"url":"https://api.github.com/repos/aarondcoleman/Fitbit.NET/issues/comments/98217648","html_url":"https://github.com/aarondcoleman/Fitbit.NET/issues/46#issuecomment-98217648","issue_url":"https://api.github.com/repos/aarondcoleman/Fitbit.NET/issues/46","id":98217648,"user":{"login":"jeremiahlee","id":244377,"avatar_url":"https://avatars.githubusercontent.com/u/244377?v=3","gravatar_id":"","url":"https://api.github.com/users/jeremiahlee","html_url":"https://github.com/jeremiahlee","followers_url":"https://api.github.com/users/jeremiahlee/followers","following_url":"https://api.github.com/users/jeremiahlee/following{/other_user}","gists_url":"https://api.github.com/users/jeremiahlee/gists{/gist_id}","starred_url":"https://api.github.com/users/jeremiahlee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeremiahlee/subscriptions","organizations_url":"https://api.github.com/users/jeremiahlee/orgs","repos_url":"https://api.github.com/users/jeremiahlee/repos","events_url":"https://api.github.com/users/jeremiahlee/events{/privacy}","received_events_url":"https://api.github.com/users/jeremiahlee/received_events","type":"User","site_admin":false},"created_at":"2015-05-01T19:46:19Z","updated_at":"2015-05-01T19:46:19Z","body":"Revision to my previous comment: we're going to launch with a 60 minute access token lifetime."}}