Oauth2 error with MapMyFitness API

I'm trying to use the MapMyFitness API (www.mapmyapi.com) with Ruby on Rails 3.2 and the oauth2 gem. First, my app generates the auth_url in "get_auth_url". The browser then navigates to it and a callback is returned to "mapmyfitness_callback" once authenticated. The "mapmyfitness_callback" also gets the list of "workouts" and those are displayed in the browser.

The problem is when the user selects a workout to download. To retrieve the selected workout, I call "get_workout". However, I'm having difficulties getting the appropriate token for the request.

The line below crashes:

workout_data = access_token.get('/v7.0/workout/' + workout_id, :params => { 'field_set' => 'time_series' }, :headers => {'Api-Key' => ENV['MMF_API_KEY'], 'Authorization' => auth_token}).body

with: OAuth2::Error (: {"oauth1_error":"Malformed authorization header","oauth1_error_code":"OAUTH1:UNKNOWN"}): app/controllers/telemetry_controller.rb:60:in `get_workout'

The entire controller code:

require 'oauth2'

class TelemetryController < ApplicationController

  def get_auth_url  
    auth_url = mmf_client.auth_code.authorize_url(:redirect_uri => 'http://localhost:3000/telemetry/mapmyfitness_callback')

    respond_to do |format|
      format.json{ render :json => {:auth_url => auth_url}.to_json }
    end  
  end

  def mapmyfitness_callback

    # Get user
    @code = params[:code]
    token = mmf_client.auth_code.get_token(@code, :redirect_uri => 'http://localhost:3000/telemetry/mapmyfitness_callback', :headers => {'Api-Key' => ENV['MMF_API_KEY']})
    mmf_user = JSON.parse(token.get('/v7.0/user/self', :headers => {'Api-Key' => ENV['MMF_API_KEY'], 'Authorization' => @code}).body)
    mmf_user_id = mmf_user['id']

    @auth_token = token.token

    # Get workouts
    mmf_workouts = JSON.parse(token.get('/v7.0/workout', :params => { 'user' => mmf_user_id }, :headers => {'Api-Key' => ENV['MMF_API_KEY'], 'Authorization' => @code}).body)

    @workout_list = Array.new
    mmf_workouts['_embedded']['workouts'].each do |workout|
      workout_data = {:name => workout['name'],
                      :id => workout['_links']['self'][0]['id']}
      @workout_list.push(workout_data)
    end        

    render :layout => false

  end

  def get_workout

    code = params[:code]
    auth_token = params[:auth_token]

    access_token = OAuth2::AccessToken.new(mmf_client, auth_token, {
        :mode => :query,
        :param_name => "oauth2_access_token",
    })    

    puts access_token.to_yaml

    # Get workout
    workout_id = params[:workout_id]
    workout_data = access_token.get('/v7.0/workout/' + workout_id, :params => { 'field_set' => 'time_series' }, :headers => {'Api-Key' => ENV['MMF_API_KEY'], 'Authorization' => auth_token}).body

    respond_to do |format|
      format.json{ render :json => {:mmf_workout_data => workout_data}.to_json }
    end

  end

  private

  def mmf_client

    client = OAuth2::Client.new(
        ENV['MMF_API_KEY'],
        ENV['MMF_SECRET_KEY'], 
        :authorize_url => "https://www.mapmyfitness.com/v7.0/oauth2/authorize/", 
        :token_url => "https://oauth2-api.mapmyapi.com/v7.0/oauth2/access_token/", 
        :site => "https://oauth2-api.mapmyapi.com"
    )

  end

end

I figured it out. get_workout needs to be like this:

  def get_workout

    auth_token = params[:auth_token]

    token = OAuth2::AccessToken.new(mmf_client, auth_token)

    # Get workout
    workout_id = params[:workout_id]
    workout_data = token.get('/v7.0/workout/' + workout_id, :params => { 'field_set' => 'time_series' }, :headers => {'Api-Key' => ENV['MMF_API_KEY'], 'Authorization' => auth_token}).body

    respond_to do |format|
      format.json{ render :json => {:mmf_workout_data => workout_data}.to_json }
    end

  end