title: Fitbit Chrome Extension using only client side code
body: <p>I'm building a Chrome Extension application that will only allow a user to visit certain websites if the user has completed 10k steps.  I am having trouble with the Fitbit API (<a href="https://wiki.fitbit.com/display/API/Fitbit+API" rel="nofollow">https://wiki.fitbit.com/display/API/Fitbit+API</a>).  I'd like all the code to be in the client but I'm having trouble figuring out how to authenticate and make requests to Fitbit from an extension.  I already added permissions to my manifest.json so that I won't have to worry about CORS.  Anyone have experience with this?  I can only find information on how to use a server to authenticate with the Fitbit API.</p>
  
  <p>Here is my attempt at the first call to Fitbit to begin the OAuth:</p>
  
  <pre><code>    $.ajax({
          'url' : 'api.fitbit.com',
          'type' : 'POST',
          'data' : {
            'oauth_signature_method' : "HMAC-SHA1",
            'oauth_timestamp' : Date.now(),
            'oauth_nonce' : "161822064",
            'oauth_callback' : "http%3A%2F%2Fexample.fitbit.com%2Fapp%2FcompleteAuthorization",
            'oauth_signature' : "Omf%2Bls2gn%2BDlghq245LRIyfMdd8%3D",
            'oauth_version' : "1.0",
            'oauth_consumer_key' : "fitbit-example-client-application"
          },
          'success' : function(data) {
            console.log(data);
          }
        });
  </code></pre>