Sorry for this answer coming two years late but maybe it will be of help to someone.
Once you know a user's token & token secret you can subscribe to their feed using the following OAUTH POST request. This URL is for their activities feed.
<?php
$consumerKey = "lajsdf23l4l8asdfn238ladf8xjk92oi"; //From Fitbit's website when you sign up for an app
$consumerSecret = "l8adl3halsdf82p9adfads2gjadsf"; //From Fitbit's website when you sign up for an app
$oauth = new OAuth($consumerKey,$consumerSecret,OAUTH_SIG_METHOD_HMACSHA1,OAUTH_AUTH_TYPE_AUTHORIZATION);
$usersToken = "k28a9wifvnc89w2o8oigaad8e23r23jf";
$usersSecret = "234o8fdofsy8df89aydfoyo84e2902af";
$oauth->setToken($usersToken,$usersSecret);
$subscriptionURL = "https://api.fitbit.com/1/user/-/activities/apiSubscriptions.json";
try{
//Send a POST to subscribe as stated on https://wiki.fitbit.com/display/API/Fitbit+Subscriptions+API
$oauth->fetch($subscriptionURL, null, OAUTH_HTTP_METHOD_POST);
print_r(json_decode($oauth->getLastResponse())); // Make sure the request was successful
}
catch(Exception $e){
echo 'ERROR:';
print_r($e);
print_r($oauth->getRequestHeader('POST', $url));
}
Your subscriber URL endpoint should be a webpage where you have some code that can receive the Fitbit data and do whatever you need done with it. Below is some PHP code that would get you started.
<?php
// Get the input data and create a PHP object to use.
$fitbitPushData = file_get_contents("php://input");
$fitbitData = json_decode($fitbitPushData);
For testing purposes, I suggest first creating a RequestBin at http://requestb.in/ and using that as your Subscriber endpoint URL. This way you can easily see the data Fitbit sends when someone syncs. You can copy that JSON string to your subscriber URL endpoint code and test how you want to handle the data before setting your site to be the subscription endpoint URL.
A couple other lessons I've learned:
Depending on the amount of users you have you may want your subscriber URL on a different server. This URL will get hit every time a user syncs their Fitbit which can result in a lot of traffic. Fitbit will disable your subscriber URL if it fails 10% of the time or more or if it is unable to respond within 3 seconds.
Another important part is that this doesn't send you the user's most recent data. It only lets you know that they have updated their data. You still have to make an API request to get their latest data. You can also only make 150 API requests per user per hour so it may be good to put a limit on how often you check each user. I have had a few users who were syncing constantly which resulted in receiving e-mails every hour from Fitbit that stated my app had exceeded the rate limit for those users.
