Fitbit Web API Retirement: Deadlines and the Migration Path

Google announced the end of two of its fitness developer platforms on overlapping timelines, and the single most expensive mistake a team can make is assuming they are the same project. They are not. This page is about the Fitbit one — the legacy Fitbit Web API that backends call with a Bearer token.

Two shutdowns, not one#

People arrive here having read something about "Google shutting down its fitness API" and cannot tell which one hit them. The two events are genuinely separate: different products, different published language, different successors.

The confusion is understandable, because the two roads meet at one point: the Google Health API is a destination for both a Fit REST integration and a Fitbit Web API integration. But it is not the only Fit destination, and it is not Health Connect. Health Connect is an on-device Android store with no server endpoint; the Google Health API is a cloud REST API your backend calls. If you are here for the Fit side, the Google Fit shutdown hub owns that event and the Google Fit deprecation triage page owns the symptom. Everything below is Fitbit-only.

What is confirmed, what is reported#

This is the section to read twice. For months the dates circulated with more confidence than the evidence supported; on October 12, 2026 we could finally read Google's own Health API pages, and the table below marks what they confirm.

Two hygiene notes. First, the dates are now published and close: if a user has not re-consented by the October 30, 2026 turn-off, Google's migration guide says their data stays available as long as they keep syncing their device to the Google Health app, and you can backfill it once they re-authenticate, so plan for a gap you can fill rather than a seamless cutover. Second, do not import figures from the enterprise Google Cloud Healthcare API, which publishes per-request pricing, as if they described the consumer Google Health API — our Fitbit pricing page explains why those are different products.

Google's Health API pages are the ones to watch: Google notes that the API "is actively evolving" and that changes may require updates on your end. We could not reach Fitbit's own developer pages, most recently on October 12, 2026.

Your migration path by integration shape#

The work is not the same for everyone. Find your shape first; the destination follows from it.

Shape 1: a server-side Fitbit Web API consumer#

Your backend holds refresh tokens, mints eight-hour access tokens (the commonly documented expires_in value is 28800 seconds), and polls api.fitbit.com on a schedule. This is the shape with the most exposure, because every piece of it changes: new developer console, Google OAuth 2.0 instead of Fitbit's authorization server, and roughly 100-plus individual endpoints collapsing into bundled data types with a new response format.

Treat it as a re-integration, not a version bump. The Fitbit Web API to Google Health playbook is the step-by-step: audit your endpoint and scope usage, register on the new console, build an old-endpoint to new-data-type mapping table, put an abstraction layer over your health-data service so both paths can run at once, then move users in cohorts. For the mapping table, the Google Health API reference lists every data type on Google's data-types page with its operations and scopes, and its Fitbit Web API mapping carries Google's own tables from Fitbit data types, scopes and endpoints to their replacements. If the OAuth provider swap is the unfamiliar part, what OAuth means for health data covers the grant model you are replacing. And while you are still on the legacy path, Fitbit error code 401 and the Fitbit 429 rate limit page cover the two failures you will keep seeing for as long as the legacy path answers.

Shape 2: a mobile app reading Fitbit through an aggregator or a platform store#

If Fitbit reaches you through a health-data aggregator, the retirement may be largely absorbed for you: an aggregator that supports both the legacy Web API and the Google Health API can take the OAuth and schema change on its side while you keep one integration. Vendors reported to have been preparing for this included Terra, Validic, Thryve, Fitabase and Rook — readiness varies, so confirm your provider's current status rather than assuming. Sahha, a separate company from Thryve, says Fitbit data on Android reaches its SDK through Health Connect. The aggregator category roundup explains how the insulation works, and consolidating wearables behind an aggregator is the move itself if you were juggling Fitbit alongside three other direct integrations.

One caveat that no aggregator removes: it caps the engineering to one integration, but it does not erase the user reconnect step. If the underlying grant changes provider, your users still act.

If instead you read Fitbit data that the user has synced into Apple HealthKit or Google Health Connect, you are on the on-device path and this retirement touches you least — but you also have no server-side read, so the Health Connect integration guide and the data-type reference are where the real constraints live.

Shape 3: analytics and history, not live sync#

If Fitbit is a research or reporting input — cohort dashboards, longitudinal analysis, a data warehouse — your risk is not the endpoint, it is the history. Back-fill depth on any new source is capped by the underlying provider, not by you, and the caps vary sharply between providers. Plan to preserve what you already hold rather than assuming you can re-pull it later: historical backfill and incremental sync cover doing that without corrupting the series you have. If a whole cohort silently fails to reconnect, the gap in your analysis outlives the migration by years, which is why keeping users connected during a migration matters as much here as it does for a live product. If those users are research participants, Fitbit data for research studies after the turndown covers what Google's research policy adds on top.

Still deciding whether the successor is even the right destination? Fitbit API alternatives weighs the Google Health API against aggregators and other single-vendor APIs, and Fitbit API vs Garmin API covers the standardize-on-one-device option.

An action checklist#

Per Google's Health API page, support ended on September 30, 2026 and the turn-off is October 30, 2026, so this checklist is ordered by where your migration stands. Until the turn-off your legacy calls still answer, without support; after it they will not.

If you have not started. Inventory every Fitbit endpoint, scope and data type you consume, plus your user volume and where refresh tokens live — the inventory is what turns the rest of this into a lookup instead of a scavenger hunt. Subscribe to Fitbit's and Google's official developer notices and record every date you find with a "verify" flag. Put an abstraction layer over your health-data service so the legacy and successor paths can coexist for as long as both answer. Register on the Google Health API console and confirm what data-type coverage actually exists for the types you depend on; parity is not guaranteed.

If you have not migrated yet and the legacy path still answers. Stand up the successor path in parallel and dual-read, comparing values against the legacy path rather than trusting the new one on faith. Ship the re-consent flow as a first-class piece of UX, not a cleanup task, and surface the Google Health account-linking step in your messaging, since Google's migration guide says calls for users who have not linked fail with ACCOUNT_NOT_LINKED. Instrument per-user connection status and data freshness so you can see which cohorts have actually moved. Then migrate in waves with a rollback path, chasing stragglers with reminders. Move as fast as the re-consent flow allows: Google's page says the legacy path stops on October 30, 2026, and a migration executed under that kind of pressure is where data gets lost.

Once the legacy path stops answering. Expect a long tail of users who never saw the prompt; keep the reconnect flow alive for them and keep reporting the gap honestly rather than backfilling around it. Reconcile your history against what you captured before cutover and document what could not be recovered. Only then retire the legacy Fitbit code. The reusable version of this whole sequence, for the next provider that does this to you, is migrating off a deprecated fitness API.

How this page was sourced#

Most facts above are drawn from our own reviewed pages on the Fitbit and Google Fit transitions, each of which carries its own verification date. Vendor statements checked directly: on October 2, 2026, Google's statement on developer.android.com that the Fit APIs "will be supported until the end of 2026", and the table in Google's Fit migration guide (updated September 10, 2026) that lists the Google Health API as the recommended path for Fitbit Web API integrations; on October 12, 2026, Google's Google Health API page for the end-of-support and turn-off dates and the Restricted-scope review, and Google's Health API migration guide for token transfer, re-consent, account linking and backfill; on October 17, 2026, Google's Quotas and Rate Limits page (last updated May 18, 2026) for the default quotas. We could not reach Fitbit's own developer documentation. Check the current notices before you commit a schedule.