Fitbit Web API Retirement: Deadlines and the Migration Path

Two Google-owned fitness platforms are being turned down on overlapping timelines, and the single most expensive mistake a team can make this year is assuming they are the same project. They are not. This page is about the Fitbit one — the legacy Fitbit Web API that your backend calls with a Bearer token today.

Two shutdowns, not one#

People arrive here having read something about "Google shutting down its fitness API" and cannot tell which one hit them. The two events are genuinely separate: different products, different published language, different successors.

The confusion is understandable, because the two roads meet at one point: the Google Health API is a destination for both a Fit REST integration and a Fitbit Web API integration. But it is not the only Fit destination, and it is not Health Connect. Health Connect is an on-device Android store with no server endpoint; the Google Health API is a cloud REST API your backend calls. If you are here for the Fit side, the Google Fit shutdown hub owns that event and the Google Fit deprecation triage page owns the symptom. Everything below is Fitbit-only.

What is confirmed, what is reported#

This is the section to read twice, because most of the panic content circulating about this deadline states a date with more confidence than the evidence supports.

Two hygiene notes that matter more than the calendar. First, a plan that depends on the exact shutoff day has already failed; build a plan that is safe whether the door closes in August or December. Second, do not import figures from the enterprise Google Cloud Healthcare API, which publishes per-request pricing, as if they described the consumer Google Health API — our Fitbit pricing page explains why those are different products.

Verify the current dates against Google's and Fitbit's own developer notices before you schedule anything. We could not reach those pages during this review, and we would rather say so than invent a date.

Your migration path by integration shape#

The work is not the same for everyone. Find your shape first; the destination follows from it.

Shape 1: a server-side Fitbit Web API consumer#

Your backend holds refresh tokens, mints eight-hour access tokens (the commonly documented expires_in value is 28800 seconds), and polls api.fitbit.com on a schedule. This is the shape with the most exposure, because every piece of it changes: new developer console, Google OAuth 2.0 instead of Fitbit's authorization server, and roughly 100-plus individual endpoints collapsing into bundled data types with a new response format.

Treat it as a re-integration, not a version bump. The Fitbit Web API to Google Health playbook is the step-by-step: audit your endpoint and scope usage, register on the new console, build an old-endpoint to new-data-type mapping table, put an abstraction layer over your health-data service so both paths can run at once, then move users in cohorts. If the OAuth provider swap is the unfamiliar part, what OAuth means for health data covers the grant model you are replacing. And while you are still on the legacy path, Fitbit error code 401 and the Fitbit 429 rate limit page cover the two failures that will keep firing right up until turndown.

Shape 2: a mobile app reading Fitbit through an aggregator or a platform store#

If Fitbit reaches you through a health-data aggregator, the retirement may be largely absorbed for you: an aggregator that supports both the legacy Web API and the Google Health API can take the OAuth and schema change on its side while you keep one integration. Vendors reported to be preparing for this include Terra, Validic, Thryve/Sahha, Fitabase and Rook — readiness varies, so confirm your provider's current status rather than assuming. The aggregator category roundup explains how the insulation works, and consolidating wearables behind an aggregator is the move itself if you were juggling Fitbit alongside three other direct integrations.

One caveat that no aggregator removes: it caps the engineering to one integration, but it does not erase the user reconnect step. If the underlying grant changes provider, your users still act.

If instead you read Fitbit data that the user has synced into Apple HealthKit or Google Health Connect, you are on the on-device path and this retirement touches you least — but you also have no server-side read, so the Health Connect integration guide and the data-type reference are where the real constraints live.

Shape 3: analytics and history, not live sync#

If Fitbit is a research or reporting input — cohort dashboards, longitudinal analysis, a data warehouse — your risk is not the endpoint, it is the history. Back-fill depth on any new source is capped by the underlying provider, not by you, and the caps vary sharply between providers. Plan to preserve what you already hold rather than assuming you can re-pull it later: historical backfill and incremental sync cover doing that without corrupting the series you have. If a whole cohort silently fails to reconnect, the gap in your analysis outlives the migration by years, which is why keeping users connected during a migration matters as much here as it does for a live product.

Still deciding whether the successor is even the right destination? Fitbit API alternatives weighs the Google Health API against aggregators and other single-vendor APIs, and Fitbit API vs Garmin API covers the standardize-on-one-device option.

A dated action checklist#

Dated deliberately, because the reported window is short and the reported dates are the only ones anyone has.

This month, whatever the date turns out to be. Inventory every Fitbit endpoint, scope and data type you consume, plus your user volume and where refresh tokens live — the inventory is what turns the rest of this into a lookup instead of a scavenger hunt. Subscribe to Fitbit's and Google's official developer notices and record every date you find with a "verify" flag. Put an abstraction layer over your health-data service now, before you need it, so the legacy and successor paths can coexist. Register on the Google Health API console and confirm what data-type coverage actually exists for the types you depend on; parity is still evolving and is not guaranteed.

Before the reported date. Stand up the successor path in parallel and dual-read, comparing values against the legacy path rather than trusting the new one on faith. Ship the re-consent flow as a first-class piece of UX, not a cleanup task, and surface the Google Account consolidation step in your messaging, since un-consolidated users are reportedly locked out entirely. Instrument per-user connection status and data freshness so you can see which cohorts have actually moved. Then migrate in waves with a rollback path, chasing stragglers with reminders. Aim to finish comfortably early — a migration executed under deadline pressure is where data gets lost.

After the legacy path stops answering. Expect a long tail of users who never saw the prompt; keep the reconnect flow alive for them and keep reporting the gap honestly rather than backfilling around it. Reconcile your history against what you captured before cutover and document what could not be recovered. Only then retire the legacy Fitbit code. The reusable version of this whole sequence, for the next provider that does this to you, is migrating off a deprecated fitness API.

How this page was sourced#

Every fact above is drawn from our own reviewed pages on the Fitbit and Google Fit transitions, each of which carries its own verification date. The one directly quoted vendor line is Google's statement that Fit APIs "will be supported until the end of 2026", verified against developer.android.com on July 31, 2026. We could not reach Fitbit's or Google's developer documentation while writing this, so nothing here is presented as a freshly confirmed vendor date, and the September 2026 shutoff in particular is reported rather than official. Check the current notices before you commit a schedule.