--- title: "How to Integrate the Dexcom API (2026)" canonical: "https://aifitnessapi.com/integrate/dexcom-api" cluster: "Integration Guides" primary_query: "dexcom api" last_reviewed: "2026-10-17" description: "Integrate the Dexcom CGM API: registration, Limited and Full Access reviews, OAuth with a one-minute code, v3 endpoints, the 30-day window and data delays." publisher: "AIFitnessAPI — independent, not sponsored" cite_as: "\"How to Integrate the Dexcom API (2026)\", AIFitnessAPI, https://aifitnessapi.com/integrate/dexcom-api" --- # How to Integrate the Dexcom API (2026) > The Dexcom API gives authorized apps a user's continuous glucose monitor data, including estimated glucose values, events, calibrations, alerts and device details, over OAuth 2.0. Registration is free and comes with a sandbox of simulated users; real data needs Dexcom's approval, first Limited Access for up to 5 users under a Data Licensing Agreement, then Full Access after a technical and commercial review. Authorization codes expire after one minute, queries are limited to 30-day windows, app-uploaded data arrives one hour late in the US and three hours elsewhere, and apps may make 60,000 calls an hour. - Canonical: https://aifitnessapi.com/integrate/dexcom-api - Last reviewed: 2026-10-17 - Publisher: AIFitnessAPI (https://aifitnessapi.com) — independent, not sponsored - Cite as: "How to Integrate the Dexcom API (2026)", AIFitnessAPI, https://aifitnessapi.com/integrate/dexcom-api --- Dexcom's API returns continuous glucose monitor (CGM) data, such as estimated glucose values and events, to apps that Dexcom users authorize. Access is staged: anyone can register and build against simulated data, but real users' data needs Dexcom's approval, first for a handful of test users and then for a commercial launch. Everything below is from Dexcom's developer documentation as read on October 17, 2026. For other connected health devices, see the [Withings API guide](/integrate/withings-api). ## Access and approval Dexcom describes three levels of access: | Level | What it allows | How you get it | |---|---|---| | Registered Developer | App credentials, the sandbox environment and support requests | Free registration at developer.dexcom.com, accepting the Registered Developer Agreement | | Limited Access | Up to 5 authorized users of real data, for testing | Apply for an upgrade from the app's profile; Dexcom's Strategic Partnerships team reviews it and, if it agrees, sends a standard, non-negotiable Data Licensing Agreement | | Full Access | A commercial app for any Dexcom user | Apply with the Full Access Questionnaire; Dexcom runs a technical and commercial review of the app | Dexcom splits Limited Access requests by who you are. Individual developers apply from the app's profile; commercial app developers submit a request for a commercial partnership through Dexcom's partnership questionnaire; research use goes through a separate research portal. Dexcom says it values every company that applies but reserves the right to decline apps that do not meet certain commercial and technical standards. Each app is reviewed on its own, so a second app needs its own upgrade. Once an app has Full Access and at least one active Dexcom user within 60 days of public availability, the developer can apply to become a Dexcom Digital Health Partner and appear in Dexcom's Partnerships Gallery, which Dexcom says is not an endorsement. Dexcom also reminds developers that complying with all applicable regulations is their responsibility, and points to the FDA's Digital Health site for US rules. ## Auth and scopes Dexcom uses OAuth 2.0 with the authorization-code flow, and requires partners to keep tokens and the client secret on their servers, never on a mobile device. Send the user to Dexcom's login: ```http GET https://api.dexcom.com/v3/oauth2/login ?client_id=YOUR_CLIENT_ID &redirect_uri=https://yourapp.example.com/callback &response_type=code &scope=offline_access &state=RANDOM_ANTI_CSRF_STRING ``` `code` is the only response type and `offline_access` the only scope you can request. Behind that scope, the HIPAA authorization the user signs lists four kinds of data: estimated blood glucose levels, calibration data, events entry data and device details. Neither you nor the user can pick a subset. The user logs in with their Dexcom account, signs the HIPAA authorization, and comes back with a code that is **single-use and expires after one minute**. Exchange it at `https://api.dexcom.com/v3/oauth2/token`: ```bash curl -s -X POST "https://api.dexcom.com/v3/oauth2/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d grant_type=authorization_code \ -d code=AUTHORIZATION_CODE \ -d redirect_uri=https://yourapp.example.com/callback \ -d client_id=YOUR_CLIENT_ID \ -d client_secret=YOUR_CLIENT_SECRET ``` Dexcom's example response has an access token with `expires_in` of 7200 seconds and a refresh token. Each refresh token works once: exchanging it issues a new one and invalidates the old, and a refresh token is valid for at most one year. A 401 on a data call means refresh; a 400 on a refresh means the token is dead, for example because the user revoked access or reset their Dexcom password, and the user must authorize again. Users revoke apps from Permissions in their Dexcom account, and Dexcom says data already provided to your app is not affected by the revocation. ## Data: the v3 endpoints | Endpoint | Returns | |---|---| | `GET /v3/users/self/egvs` | Estimated glucose values | | `GET /v3/users/self/events` | User-entered events | | `GET /v3/users/self/calibrations` | Calibration entries | | `GET /v3/users/self/alerts` | Alerts | | `GET /v3/users/self/devices` | Device information | | `GET /v3/users/self/dataRange` | The time range the user has data for | ```bash curl -s "https://api.dexcom.com/v3/users/self/egvs?startDate=2026-10-01T00:00:00&endDate=2026-10-02T00:00:00" \ -H "Authorization: Bearer ACCESS_TOKEN" ``` The base URL depends on the user's region: `https://api.dexcom.com` in the US, `https://api.dexcom.eu` for the EU and outside the US, and `https://api.dexcom.jp` for Japan. The v3 API covers data from Dexcom G6, G7, G7 15-day, Dexcom ONE and Dexcom ONE+ devices; Dexcom ONE and ONE+ are not sold in the United States. Four data rules shape every query: - **A 30-day window.** Every endpoint except `/dataRange` needs `startDate` and `endDate`, and a window over 30 days returns 400. The window includes `startDate` and excludes `endDate`, and it is matched against `systemTime`. - **Two clocks.** Records carry `systemTime`, the device's UTC time, and `displayTime`, what the user sees; Dexcom notes that `systemTime` is not true UTC because of drift and user changes. - **mg/dL only.** Glucose values come in mg/dL and trend rates in mg/dL/min; converting to mmol/L is your job. - **Delayed data.** Data uploaded from Dexcom's mobile apps reaches the API with a one-hour delay in the United States and three hours elsewhere, including Japan. Uploads from a receiver through Dexcom's uploader are available immediately. ## Sandbox Every Registered Developer can call `https://sandbox-api.dexcom.com` with simulated users, named for the G6, G7, Dexcom ONE and G7 15-day apps, through the same OAuth flow, choosing the user from a drop-down instead of entering a password. Dexcom warns that sandbox data is not guaranteed to match production or to be permanent, and should not be used for formal testing, validation or training algorithms. ## Rate limits and transport Dexcom limits requests to 60,000 calls per app per hour and returns 429 above that. The API requires TLS 1.3. ## What changed recently Dexcom's developer documentation publishes no dated changelog. The current documentation describes the v3 API, with support for the G7 15-day sensor alongside G6, G7, Dexcom ONE and Dexcom ONE+. ## Gotchas and production notes - **The one-minute code.** Exchange the authorization code immediately. - **All or nothing.** The HIPAA authorization covers all four data scopes; there is no way to ask for less. - **Server-side only.** Dexcom requires tokens on your servers, not in the mobile app. - **Mind the delay.** A one-hour or three-hour delay is normal for app uploads, so do not treat a gap as missing data. - **Region-specific hosts.** Send each user's calls to the right regional base URL. - **Limited Access is for testing.** Five real users is the ceiling until Full Access. The rest of the cluster is at [how to integrate a fitness or health API](/integrate). ## Sources - [developer.dexcom.com/docs/](https://developer.dexcom.com/docs/) — Developer Program, Digital Health Partners, right to decline (checked 2026-10-17) - [developer.dexcom.com/docs/dexcom/getting-started](https://developer.dexcom.com/docs/dexcom/getting-started) — registration, sandbox, Limited Access for up to 5 users, Full Access (checked 2026-10-17) - [developer.dexcom.com/docs/dexcom/scopes-access](https://developer.dexcom.com/docs/dexcom/scopes-access) — free registration, data environments, scopes, Limited and Full Access processes, Digital Health Partner criteria (checked 2026-10-17) - [developer.dexcom.com/docs/dexcom/authentication](https://developer.dexcom.com/docs/dexcom/authentication) — OAuth endpoints, one-minute code, token lifetimes, single-use refresh tokens, revocation, errors (checked 2026-10-17) - [developer.dexcom.com/docs/dexcomv3/endpoint-overview](https://developer.dexcom.com/docs/dexcomv3/endpoint-overview) — v3 endpoints, regional base URLs, devices, TLS 1.3, rate limit, time windows, units, data delays (checked 2026-10-17) - [developer.dexcom.com/docs/dexcom/sandbox-data](https://developer.dexcom.com/docs/dexcom/sandbox-data) — sandbox base URL, simulated users and limitations (checked 2026-10-17) ## FAQ ### Is the Dexcom API free? Registration is: Dexcom calls it simple and free, and it gives you app credentials and sandbox data. Real users' data needs approval, and Dexcom sends approved Limited Access applicants a standard, non-negotiable Data Licensing Agreement. Dexcom's public documentation does not state fees, so read that agreement before you plan costs. [Permalink](https://aifitnessapi.com/integrate/dexcom-api#faq-1) ### What are Limited Access and Full Access? Limited Access lets an app authenticate up to 5 Dexcom users for testing with real data, after Dexcom's Strategic Partnerships team reviews your request. Full Access is for a commercial launch: you complete a Full Access Questionnaire and Dexcom runs a technical and commercial review of the app. Each app is reviewed separately. [Permalink](https://aifitnessapi.com/integrate/dexcom-api#faq-2) ### How does Dexcom OAuth work? Send the user to https://api.dexcom.com/v3/oauth2/login with response_type=code and scope=offline_access, the only values accepted. After login and a HIPAA authorization, exchange the single-use code within one minute at /v3/oauth2/token. Access tokens last 7,200 seconds and each refresh token works once, for up to a year. [Permalink](https://aifitnessapi.com/integrate/dexcom-api#faq-3) ### Why is Dexcom data delayed? Dexcom says data uploaded from its mobile apps reaches the API with a one-hour delay in the United States and a three-hour delay elsewhere, including Japan. Data uploaded from a receiver through Dexcom's uploader is available immediately. Build your product around the delay rather than treating it as missing data. [Permalink](https://aifitnessapi.com/integrate/dexcom-api#faq-4) ### What are the Dexcom API rate limits? Dexcom limits requests to 60,000 calls per app per hour and returns 429 when you exceed it. Each data query is also capped at a 30-day window between startDate and endDate; a longer window returns 400. The API requires TLS 1.3. [Permalink](https://aifitnessapi.com/integrate/dexcom-api#faq-5)