How to Integrate the Concept2 Logbook API (2026)

The Concept2 Logbook API reads and writes workout results in the Concept2 Logbook. Results are typed by where they happened, from rower, skierg and bike to dynamic, slides, paddle, water, snow, rollerski and multierg. It is a small, practical OAuth 2.0 API with a webhook, and reading data needs no approval at all. Everything below is from Concept2's developer pages and Logbook API documentation as read on October 17, 2026. For indoor training data from other platforms, see the Wahoo Cloud API guide.

Access and approval#

The development server's results and users may be reset from time to time, so do not rely on test data persisting there. For a personal script, Concept2 suggests generating a long-lived token from your own profile (Edit Profile, then Applications) instead of building the OAuth flow.

Auth and scopes#

Concept2 implements four OAuth 2.0 grants: authorization code, refresh, client credentials and password. Every application gets the authorization-code and refresh grants; client credentials and password are only for certain trusted applications. Send the user to the Logbook:

GET https://log.concept2.com/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &scope=user:read,results:read
  &response_type=code
  &redirect_uri=https://yourapp.example.com/logbook

Scopes are comma-separated, and a write scope includes its read scope. Always pass a scope: without one, Concept2 currently defaults to user:read,results:write for backwards compatibility and warns that this may change. Pass the same scopes again when you exchange the code and when you refresh; you can ask for fewer later, never more.

curl -s -X POST "https://log.concept2.com/oauth/access_token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d grant_type=authorization_code \
  -d code=AUTHORIZATION_CODE \
  -d redirect_uri=https://yourapp.example.com/logbook \
  -d scope=user:read,results:read

Concept2's example response has an access token with expires_in of 604800 seconds, seven days, and a refresh token. The refresh token currently lasts one year, and each refresh returns a new one, so a user who keeps using your app never has to log in again; one who stays away for over a year does.

Data: users and results#

The API lives at https://log.concept2.com/api. Send Accept: application/vnd.c2logbook.v1+json to pin version 1, which Concept2 encourages.

For incremental sync, filter with updated_after, which Concept2 interprets in GMT. When you add a result, time is in tenths of a second and date is the end of the workout as stored in the monitor, not the start. Lists are paginated with a meta.pagination block: 50 results per page by default, up to 250 with number, and 1-based page numbers. Errors come back with a status code and message; a 409 means a duplicate result, which the Logbook detects as a workout with the same date, time and distance as an existing one, and a 422 a well-formed request that failed validation. Optional headers such as X-PM-Version, X-Device and X-Erg-Model-Type let you report the performance monitor and device for debugging and analytics.

Webhook#

From the self-service developer portal you can register one webhook that fires when a result is added, updated or deleted for any user who authorized your client. Concept2 POSTs the event type, result-added, result-updated or result-deleted, with the result payload, which is the same data you would get by requesting the result, or just the result ID for a deletion.

Rate limits#

Concept2 says the API is not currently rate limited, may be in future, and that abuse will lead to rate limits or removal of access.

What changed recently#

Concept2's Logbook API documentation publishes no dated changelog. Two notes in it describe current behavior that may change: the default scope when none is passed, and the absence of rate limits.

Gotchas and production notes#

• Writes need the dev server and approval. Build any write path against log-dev.concept2.com and ask Concept2 to approve it before going live.
• Never rely on the default scope. Pass scopes on every authorize, token and refresh call.
• Seven-day tokens. Refresh weekly, and store the new refresh token each time.
• Duplicates return 409. Treat it as "already logged" when you sync results in.
• No published fee and no rate limit today. Both are statements about now, not promises, so do not hammer the API.

The rest of the cluster is at how to integrate a fitness or health API.