Bolt.new AI and Fitbit API integration: Step-by-Step Guide 2025

You integrate Bolt.new with the Fitbit API the same way you integrate any external OAuth‑protected API: by writing normal backend code (Node/Express inside Bolt’s server file), registering an OAuth app with Fitbit, storing the client credentials in Bolt environment variables, running the OAuth authorization flow, receiving Fitbit’s authorization code, exchanging it for an access token, then calling Fitbit’s REST endpoints from your Bolt backend. Bolt.new does not have any special integration features — it simply runs your code in a sandbox, so you integrate with Fitbit exactly like you would in any cloud environment.

 

What You Actually Do

 

You’ll build a tiny OAuth callback endpoint in Bolt (Node.js/Express), open the Fitbit OAuth consent screen, handle the redirect, store the access token, and then make REST calls to Fitbit’s API. Fitbit uses real OAuth 2.0 Authorization Code Flow. This means you redirect the user to Fitbit’s login page, Fitbit redirects back to your Bolt backend with a code, and you exchange that code for a token.

• Frontend in Bolt opens the Fitbit authorization URL.
• Backend handles the OAuth callback and token exchange.
• Backend calls Fitbit endpoints using user access tokens.
• Environment variables hold CLIENT_ID, CLIENT_SECRET, and REDIRECT\_URI.

 

Step‑by‑Step Setup (Real, Valid Fitbit Flow)

 

Here is the correct, real-world process.

• Go to https://dev.fitbit.com/apps and create an app.
• Set the OAuth 2.0 redirect URL to something like:
  https://your-bolt-app-url/api/fitbit/callback
• Copy the Client ID and Client Secret.
• Place them in Bolt.new environment variables:
  FITBIT_CLIENT_ID
  FITBIT_CLIENT_SECRET
  FITBIT_REDIRECT_URI

 

Backend Example (Express in Bolt.new)

 

This is a real, working OAuth 2.0 code flow implementation for Fitbit.

// server.js

import express from "express"
import fetch from "node-fetch"
import dotenv from "dotenv"

dotenv.config()
const app = express()

// Redirect user to Fitbit's OAuth page
app.get("/api/fitbit/auth", (req, res) => {
  const authUrl = 
    "https://www.fitbit.com/oauth2/authorize" +
    "?response_type=code" +
    "&client_id=" + process.env.FITBIT_CLIENT_ID +
    "&redirect_uri=" + encodeURIComponent(process.env.FITBIT_REDIRECT_URI) +
    "&scope=activity%20heartrate%20sleep%20profile"
  
  res.redirect(authUrl)
})

// Fitbit OAuth callback redirect (Fitbit sends `code` here)
app.get("/api/fitbit/callback", async (req, res) => {
  const code = req.query.code

  const tokenUrl = "https://api.fitbit.com/oauth2/token"
  const authHeader = Buffer.from(
    process.env.FITBIT_CLIENT_ID + ":" + process.env.FITBIT_CLIENT_SECRET
  ).toString("base64")

  const tokenResponse = await fetch(tokenUrl, {
    method: "POST",
    headers: {
      "Authorization": "Basic " + authHeader,
      "Content-Type": "application/x-www-form-urlencoded"
    },
    body:
      "grant_type=authorization_code" +
      "&client_id=" + process.env.FITBIT_CLIENT_ID +
      "&redirect_uri=" + encodeURIComponent(process.env.FITBIT_REDIRECT_URI) +
      "&code=" + code
  })

  const tokenData = await tokenResponse.json()

  // For demo: show the token data
  // In production: store securely
  res.json(tokenData)
})

// Example endpoint to fetch Fitbit profile data using user's access token
app.get("/api/fitbit/profile", async (req, res) => {
  const accessToken = req.query.token  // in real app you store per-user

  const profileResponse = await fetch("https://api.fitbit.com/1/user/-/profile.json", {
    headers: { "Authorization": "Bearer " + accessToken }
  })

  const profileData = await profileResponse.json()
  res.json(profileData)
})

app.listen(3000, () => console.log("Bolt Fitbit example running"))

 

How You Use This Inside Bolt.new

 

Bolt.new lets you edit code in the browser and run it in a sandbox. The workflow is straightforward:

• Create server.js with the Express endpoints shown above.
• Add environment variables in Bolt’s sidebar.
• Run the app and open /api/fitbit/auth in the Preview window.
• Fitbit login opens → you authorize → Fitbit redirects to your callback.
• You now have a working access token and can call Fitbit APIs.

 

Important Fitbit Constraints

 

• Fitbit tokens expire; you must refresh them via grant_type=refresh_token.
• Fitbit scopes must match exactly what your app requests.
• Redirect URI must match exactly or Fitbit will reject the OAuth call.
• Fitbit returns user-specific data only after OAuth consent; there is no app-wide token.

 

Summary

 

Integrating Bolt.new with the Fitbit API is simply building a normal OAuth 2.0 flow inside a Bolt backend. You register a Fitbit app, store credentials in environment variables, create an authorization endpoint, handle the callback, exchange the code for tokens, and then call Fitbit’s REST endpoints using the access token. Bolt.new doesn’t add any special magic — it just runs your code, which makes it ideal for quickly prototyping and later deploying the integration in a real production environment.