How to Integrate Bolt.new with Fitbit API

1// app/api/fitbit/auth/route.ts
2import { NextResponse } from 'next/server';
3import { cookies } from 'next/headers';
4import crypto from 'crypto';
5
6function generateCodeVerifier(): string {
7  return crypto.randomBytes(32).toString('base64url');
8}
9
10function generateCodeChallenge(verifier: string): string {
11  return crypto.createHash('sha256').update(verifier).digest('base64url');
12}
13
14export async function GET() {
15  const clientId = process.env.FITBIT_CLIENT_ID!;
16  const redirectUri = process.env.FITBIT_REDIRECT_URI!;
17
18  const codeVerifier = generateCodeVerifier();
19  const codeChallenge = generateCodeChallenge(codeVerifier);
20  const state = crypto.randomBytes(16).toString('hex');
21
22  const cookieStore = await cookies();
23  cookieStore.set('fitbit_code_verifier', codeVerifier, {
24    httpOnly: true,
25    secure: process.env.NODE_ENV === 'production',
26    maxAge: 600,
27    path: '/',
28  });
29  cookieStore.set('fitbit_state', state, {
30    httpOnly: true,
31    secure: process.env.NODE_ENV === 'production',
32    maxAge: 600,
33    path: '/',
34  });
35
36  const scopes = ['activity', 'heartrate', 'sleep', 'profile'].join(' ');
37  const authUrl = new URL('https://www.fitbit.com/oauth2/authorize');
38  authUrl.searchParams.set('client_id', clientId);
39  authUrl.searchParams.set('redirect_uri', redirectUri);
40  authUrl.searchParams.set('response_type', 'code');
41  authUrl.searchParams.set('scope', scopes);
42  authUrl.searchParams.set('code_challenge', codeChallenge);
43  authUrl.searchParams.set('code_challenge_method', 'S256');
44  authUrl.searchParams.set('state', state);
45
46  return NextResponse.redirect(authUrl.toString());
47}

1// app/api/fitbit/callback/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3import { cookies } from 'next/headers';
4
5export async function GET(request: NextRequest) {
6  const searchParams = request.nextUrl.searchParams;
7  const code = searchParams.get('code');
8  const state = searchParams.get('state');
9  const error = searchParams.get('error');
10
11  if (error) {
12    return NextResponse.redirect(new URL('/?error=fitbit_denied', request.url));
13  }
14
15  const cookieStore = await cookies();
16  const storedState = cookieStore.get('fitbit_state')?.value;
17  const codeVerifier = cookieStore.get('fitbit_code_verifier')?.value;
18
19  if (!state || state !== storedState || !codeVerifier || !code) {
20    return NextResponse.redirect(new URL('/?error=invalid_state', request.url));
21  }
22
23  const clientId = process.env.FITBIT_CLIENT_ID!;
24  const clientSecret = process.env.FITBIT_CLIENT_SECRET!;
25  const redirectUri = process.env.FITBIT_REDIRECT_URI!;
26
27  const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
28
29  const tokenResponse = await fetch('https://api.fitbit.com/oauth2/token', {
30    method: 'POST',
31    headers: {
32      'Authorization': `Basic ${credentials}`,
33      'Content-Type': 'application/x-www-form-urlencoded',
34    },
35    body: new URLSearchParams({
36      code,
37      grant_type: 'authorization_code',
38      redirect_uri: redirectUri,
39      code_verifier: codeVerifier,
40    }).toString(),
41  });
42
43  if (!tokenResponse.ok) {
44    const err = await tokenResponse.json();
45    console.error('Token exchange failed:', err);
46    return NextResponse.redirect(new URL('/?error=token_exchange_failed', request.url));
47  }
48
49  const tokens = await tokenResponse.json();
50
51  const response = NextResponse.redirect(new URL('/dashboard', request.url));
52  response.cookies.set('fitbit_access_token', tokens.access_token, {
53    httpOnly: true, secure: true, maxAge: 28800, path: '/'
54  });
55  response.cookies.set('fitbit_refresh_token', tokens.refresh_token, {
56    httpOnly: true, secure: true, maxAge: 60 * 60 * 24 * 30, path: '/'
57  });
58  response.cookies.delete('fitbit_code_verifier');
59  response.cookies.delete('fitbit_state');
60
61  return response;
62}

1// app/api/fitbit/data/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3import { cookies } from 'next/headers';
4
5const FITBIT_ENDPOINTS: Record<string, string> = {
6  activity: '/1/user/-/activities/date/today.json',
7  heartrate: '/1/user/-/heart/date/today/7d.json',
8  sleep: '/1.2/user/-/sleep/date/today.json',
9  profile: '/1/user/-/profile.json',
10};
11
12async function refreshToken(refreshToken: string): Promise<string | null> {
13  const credentials = Buffer.from(
14    `${process.env.FITBIT_CLIENT_ID}:${process.env.FITBIT_CLIENT_SECRET}`
15  ).toString('base64');
16
17  const res = await fetch('https://api.fitbit.com/oauth2/token', {
18    method: 'POST',
19    headers: {
20      Authorization: `Basic ${credentials}`,
21      'Content-Type': 'application/x-www-form-urlencoded',
22    },
23    body: new URLSearchParams({
24      grant_type: 'refresh_token',
25      refresh_token: refreshToken,
26    }).toString(),
27  });
28
29  if (!res.ok) return null;
30  const data = await res.json();
31  return data.access_token;
32}
33
34export async function GET(request: NextRequest) {
35  const cookieStore = await cookies();
36  let accessToken = cookieStore.get('fitbit_access_token')?.value;
37  const storedRefreshToken = cookieStore.get('fitbit_refresh_token')?.value;
38  const type = request.nextUrl.searchParams.get('type') ?? 'activity';
39
40  if (!accessToken || !storedRefreshToken) {
41    return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
42  }
43
44  const endpoint = FITBIT_ENDPOINTS[type];
45  if (!endpoint) {
46    return NextResponse.json({ error: 'Unknown data type' }, { status: 400 });
47  }
48
49  let fitbitRes = await fetch(`https://api.fitbit.com${endpoint}`, {
50    headers: { Authorization: `Bearer ${accessToken}` },
51  });
52
53  if (fitbitRes.status === 401 && storedRefreshToken) {
54    const newToken = await refreshToken(storedRefreshToken);
55    if (!newToken) return NextResponse.json({ error: 'Session expired' }, { status: 401 });
56    accessToken = newToken;
57    fitbitRes = await fetch(`https://api.fitbit.com${endpoint}`, {
58      headers: { Authorization: `Bearer ${accessToken}` },
59    });
60  }
61
62  const data = await fitbitRes.json();
63  const response = NextResponse.json(data);
64  if (accessToken !== cookieStore.get('fitbit_access_token')?.value) {
65    response.cookies.set('fitbit_access_token', accessToken, {
66      httpOnly: true, secure: true, maxAge: 28800, path: '/'
67    });
68  }
69  return response;
70}

1// .env.local (add real values after deploying)
2FITBIT_CLIENT_ID=your_client_id_here
3FITBIT_CLIENT_SECRET=your_client_secret_here
4FITBIT_REDIRECT_URI=https://your-deployed-domain.netlify.app/api/fitbit/callback