Fatsecret Authentication

generated: '2026-08-12'
method: searched
source: https://platform.fatsecret.com/docs/guides/authentication
docs:
  index: https://platform.fatsecret.com/docs/guides/authentication
  oauth2: https://platform.fatsecret.com/docs/guides/authentication/oauth2
  oauth1: https://platform.fatsecret.com/docs/guides/authentication/oauth1
  oauth1_three_legged: https://platform.fatsecret.com/docs/guides/authentication/oauth1/three-legged
note: >-
  Upgraded from derived to searched on 2026-08-12 with the provider's auth guides and a live probe of
  the authorization server's OIDC discovery document.
summary:
  types: [oauth2, http]
  oauth2_flows: [clientCredentials]
  api_key_in: []
  two_plane: >-
    Two authentication planes that are not interchangeable. Catalog data (foods, recipes, reference)
    uses OAuth 2.0 client_credentials — an APPLICATION identity. Member data (food diary, exercise
    diary, weight, favorites, saved meals) uses 3-legged OAuth 1.0a — a MEMBER identity. An agent
    holding only a client-credentials token cannot read or write any profile surface.
authorization_server:
  issuer: https://oauth.fatsecret.com
  openid_configuration: https://oauth.fatsecret.com/.well-known/openid-configuration
  probed: '2026-08-12'
  http_status: 200
  endpoints:
    authorization: https://oauth.fatsecret.com/connect/authorize
    token: https://oauth.fatsecret.com/connect/token
    userinfo: https://oauth.fatsecret.com/connect/userinfo
    introspection: https://oauth.fatsecret.com/connect/introspect
    revocation: https://oauth.fatsecret.com/connect/revocation
    device_authorization: https://oauth.fatsecret.com/connect/deviceauthorization
    end_session: https://oauth.fatsecret.com/connect/endsession
    jwks: https://oauth.fatsecret.com/.well-known/openid-configuration/jwks
  id_token_signing_alg: [RS256]
  code_challenge_methods: [plain, S256]
  subject_types: [public]
schemes:
  - name: oauth2
    type: oauth2
    flows:
      - flow: clientCredentials
        tokenUrl: https://oauth.fatsecret.com/connect/token
        scopes: 7
        scope_list: [basic, premier, barcode, localization, nlp, image-recognition, feedback]
    credential: Consumer Key (client_id) + Consumer Secret (client_secret) issued at registration
    request_header: 'Authorization: Bearer <access_token>'
    token_lifetime: 24 hours (default)
    provider_guidance: >-
      "fatsecret requires that OAuth 2.0 tokens be requested through a proxy server" — the secret must
      not ship in a mobile or browser client.
    sources:
      - openapi/_original/fatsecret-platform-openapi.yml
      - https://platform.fatsecret.com/docs/guides/authentication/oauth2
  - name: oauth1
    type: http
    scheme: oauth
    description: OAuth 1.0a request signing; 3-legged for member-scoped data
    signature_methods_documented: true
    scopes: 0
    sources:
      - openapi/_original/fatsecret-platform-openapi.yml
      - https://platform.fatsecret.com/docs/guides/authentication/oauth1/three-legged
    note: >-
      The profile is carried by the access token, not by a user_id parameter. OAuth 1.0a signing
      errors are reported as fatsecret error codes 2-9, not as HTTP 401.
ip_restriction:
  supported: true
  evidence: error code 21, "Invalid IP address detected"
see_also:
  scopes: scopes/fatsecret-scopes.yml
  errors: errors/fatsecret-error-codes.yml
  conventions: conventions/fatsecret-conventions.yml