Can I still create an Oura Personal Access Token?

No — as of the December 2025 deprecation, new Personal Access Tokens can no longer be created, and new integrations must use OAuth 2.0 Authorization Code with scoped Bearer tokens. Existing tokens created before the change are a separate question: treat any that still work as temporary and migrate to OAuth now. Verify the current wind-down status in Oura's own developer documentation, as of 2026.

Do my Oura API endpoints change when I move from a PAT to OAuth?

No. The v2 REST base at api.ouraring.com/v2/ and the usercollection endpoints are unchanged, and the responses are the same. What changes is the credential: instead of a personal token you send a scoped OAuth Bearer access token, which expires and is renewed via a refresh token. Migration is an auth change, not a rewrite.

Is there a simpler path than OAuth for a personal Oura project?

Not from Oura directly anymore — OAuth is the supported route for new integrations, even single-user ones, so you register an app and authorize yourself once through your own consent screen. If the ceremony is a dealbreaker and you want several wearables anyway, a health-data aggregator gives you Oura and other providers behind one integration, at the cost of a third party in the loop.

Oura Personal Access Tokens Deprecated: What to Do

Oura Personal Access Tokens Are Deprecated — Here's the Fix

Last verified August 2, 2026 · 2 min read

Oura deprecated Personal Access Tokens around December 2025: new PATs can no longer be created, and new integrations must use OAuth 2.0 Authorization Code with scoped Bearer tokens. If a tutorial tells you to paste a personal token, it predates the change. The fix is to register an OAuth application, send users through Oura's consent screen, and exchange the code for tokens — your API calls to api.ouraring.com/v2/ stay the same, only the credential changes.

Covered here:Oura

You followed a tutorial, went looking for the Personal Access Token page in the Oura dashboard, and either could not find it or found you cannot create a new one. Nothing is broken on your side: Oura deprecated Personal Access Tokens around December 2025, and new integrations must use OAuth 2.0. Every tutorial that says "paste your personal token" predates the change.

What changed, and what did not#

Gone: creating new PATs. The simple paste-a-token path for personal scripts and quick prototypes is closed to new users.
Unchanged: the API itself. The v2 REST base (https://api.ouraring.com/v2/), the usercollection endpoints, and the data — sleep, activity, readiness, heart rate, workouts, SpO2 — are the same. Only the credential in the Authorization header changes: a scoped OAuth Bearer token instead of a personal one.
If you hold an old PAT: deprecation announcements typically wind down existing tokens on their own schedule — treat any still-working PAT as living on borrowed time and migrate now rather than after it stops. Verify current status in Oura's developer documentation, since wind-down timelines are the kind of detail that changes.

The fix: move to OAuth 2.0 Authorization Code#

The full wiring — redirect URI setup, the consent screen, code exchange, token refresh — is covered step by step in the Oura API integration guide; the short version is below. If OAuth is new territory, OAuth for health data explains the moving parts in plain English first.

For a personal project, the OAuth dance feels like overkill for one user — you still register an app and authorize yourself through your own consent screen once, then store and refresh the tokens like any integration. Budget an hour, not a weekend.

While you're here#

Two adjacent traps worth knowing about. Refresh tokens are where OAuth integrations actually die in production — refresh token not working covers the rotation gotchas before they cost you a user. And if your goal was several wearables rather than Oura specifically, a health-data aggregator gives you Oura plus the rest behind one credential flow instead of one OAuth app per provider.

Frequently asked questions

Can I still create an Oura Personal Access Token?: No — as of the December 2025 deprecation, new Personal Access Tokens can no longer be created, and new integrations must use OAuth 2.0 Authorization Code with scoped Bearer tokens. Existing tokens created before the change are a separate question: treat any that still work as temporary and migrate to OAuth now. Verify the current wind-down status in Oura's own developer documentation, as of 2026.
Do my Oura API endpoints change when I move from a PAT to OAuth?: No. The v2 REST base at api.ouraring.com/v2/ and the usercollection endpoints are unchanged, and the responses are the same. What changes is the credential: instead of a personal token you send a scoped OAuth Bearer access token, which expires and is renewed via a refresh token. Migration is an auth change, not a rewrite.
Is there a simpler path than OAuth for a personal Oura project?: Not from Oura directly anymore — OAuth is the supported route for new integrations, even single-user ones, so you register an app and authorize yourself once through your own consent screen. If the ceremony is a dealbreaker and you want several wearables anyway, a health-data aggregator gives you Oura and other providers behind one integration, at the cost of a third party in the loop.

From the blog

Findings counted out of this site’s own datasets.

6 Confirmed, 7 Reported: Grade Your DatesWe track 13 dated ecosystem changes. Only 6 come from a primary source. A confirmed date is a plan; a reported one is a rumour with a number on it.

Independent comparison, last reviewed August 2, 2026. Pricing, rate limits, and feature availability change often — confirm current details in each provider’s official documentation before you commit. Product and company names are trademarks of their respective owners; AIFitnessAPI is not affiliated with, endorsed by, or sponsored by any product listed here.