OAuth error after installing on pythonanywhere - oauth-2.0

Question

I developed a Python webapp using Bottle locally and have it (mostly) working on pythonanywhere.
That said, when I try to authenticate a user (which worked on my local installation), I get the following error:
Redirect_uri mismatch: null. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process.
I have updated my fitbit api application settings and triple-checked that my redirect_uri in the setting matches that in my application.
Taking a look at the fitbit docs forums, it appears that this could be a percent-encoding issue where...
https://www.fitbit.com/login?disableThirdPartyLogin=true&redirect=%2Foauth2%2Fauthorize%3Fclient_id%XXXXXXXX%26redirect_uri%3Dhttp%253A%252F%252Fexample.com%252Fcallback%26response_type%3Dcode%26scope%3Dactivity%2Bsleep%2Bweight%2Bnutrition%2Bsettings%26state%3D024
should be...
https://www.fitbit.com/login?disableThirdPartyLogin=true&redirect=%2Foauth2%2Fauthorize%3Fclient_id%XXXXXXXX%26redirect_uri%3Dhttp://example.com/callback%26response_type%3Dcode%26scope%3Dactivity%2Bsleep%2Bweight%2Bnutrition%2Bsettings%26state%3D024
The redirect to the authorization page is being built like this...
#app.route('/aas/<study_id>')
def hello(study_id):
'''This is the primary request page that redirects users to the fitbit api for authorization.'''
authorization_page = f'https://www.fitbit.com/oauth2/authorize' \
f'?response_type=code' \
f'&client_id={CLIENT_ID}' \
f'&redirect_uri={str(REDIRECT_URI)}' \
f'&scope={SCOPE}' \
f'&state={study_id}'
redirect(url=authorization_page)
Is there a way that I can prevent this encoding from happening, just to SEE if that's the problem? I assume it's being done by wsgi.
Any other thoughts/ideas greatly appreciated.

Answer 1

Thanks for looking, folks.
Turns out that I wasn't passing the URI in the Authorization Code Grant Flow (second portion of the oauth handshake) as so...
POST https://api.fitbit.com/oauth2/token
Authorization: Basic Y2xpZW50X2lkOmNsaWVudCBzZWNyZXQ=
Content-Type: application/x-www-form-urlencoded
client_id=22942C&grant_type=authorization_code&redirect_uri=http%3A%2F%2Fexample.com/callback%2Ffitbit_auth&code=1234567890
I still have no idea why it worked on my local server and not on pythonanywhere, but it's fixed.