How to Integrate the Suunto API (2026)

Suunto's cloud API is the Suunto Cloud API, run from its developer site, the Suunto API Zone. It returns the workouts and daily activity that Suunto watches sync to the Suunto App, and lets you push routes and workouts back. Everything below is from Suunto's API Zone pages as read on October 17, 2026. If you are still choosing a provider, start with wearable data APIs.

Access and approval#

After acceptance the path has three more steps. You subscribe to the Development API, which has every endpoint but smaller request limits; when you are ready you submit your app's information in your profile and subscribe to the Production API; then you submit your app's content, and Suunto grants production access and publishes the app on Suunto.com. One account holds one app, so a separate test app or a second brand needs another account and email address. If an agency builds the integration, Suunto asks the client company to apply and sign the API agreement, listing the agency's developers on the form.

Auth and keys#

The Suunto Cloud API needs two credentials on every data call: the user's OAuth 2.0 access token and your subscription key (Ocp-Apim-Subscription-Key), which you find in your API Zone profile after subscribing. Suunto gives you a primary and a secondary key so you can rotate one without downtime. The OAuth endpoints do not take the subscription key.

Set your app name, client secret and redirect URI in the OAuth settings of your profile; the client ID is generated for you. Then send the user to the authorization host:

GET https://cloudapi-oauth.suunto.com/oauth/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.example.com/oauth-redirect

The user signs in with their Suunto App account (Suunto notes that old Movescount credentials do not work) and comes back with a code. Exchange it with HTTP Basic client authentication:

curl -s https://cloudapi-oauth.suunto.com/oauth/token \
  --user "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET" \
  -d grant_type=authorization_code \
  -d redirect_uri=https://yourapp.example.com/oauth-redirect \
  -d code=AUTHORIZATION_CODE

Suunto's example response holds an access_token, a refresh_token, expires_in of 86400 seconds and the workout scope. The access token is a JWT, and its custom user claim is the user's Suunto App username, which you will need to match webhook notifications to users. Suunto has no mobile SDK; it says the authorization process is optimized for mobile use.

Data you can read and write#

Data calls go to https://cloudapi.suunto.com with both headers:

curl -s "https://cloudapi.suunto.com/v2/workouts" \
  -H "Authorization: Bearer JWT_ACCESS_TOKEN" \
  -H "Ocp-Apim-Subscription-Key: YOUR_SUBSCRIPTION_KEY"

Use the workout list for history and FIT files for full detail. Workout JSON gives startTime and stopTime in UNIX epoch milliseconds plus timeOffsetInMinutes, the user's offset from UTC when the exercise stopped. What a FIT file contains depends on the watch model and the sport mode the user chose, so a missing GPS track can be the device, not your parser.

Webhooks#

Suunto sends a webhook when a new workout syncs. Register the URL in your app's OAuth settings in the API Zone; it must be publicly reachable. Each notification is a POST with two parameters, username and workoutid: look up the access token by username, then fetch the workout's FIT file by its ID.

There is no webhook for daily activity. Suunto's advice is to fetch steps and calories whenever a workout notification arrives, since a synced workout means a synced watch, and otherwise to fetch daily activity about once a day for users who sync without working out. Suunto asks partners to avoid unnecessary polling.

Rate limits#

Suunto's pages say the Development API has the same capabilities as production but with rate-limited, smaller request limits. They do not publish the numbers for either API. Expect higher load at weekends and at the start of the year, which Suunto calls out as its busy periods.

What changed recently#

Suunto's API Zone publishes no dated changelog; partners hear about new capabilities through the partner newsletter Suunto adds them to on registration. Two standing notes matter for older integrations: the Movescount API is a completely separate system, and Suunto encourages everyone onto the Suunto App and the Cloud API; and apps for Suunto's China market use a separate API with different endpoints, which Suunto provides once your integration is ready.

Gotchas and production notes#

• No personal projects. Access is for companies and organizations; there is no individual tier.
• Two headers, always. A data call needs both the user's JWT access token and your subscription key; the token exchange needs only Basic client credentials.
• Workout key format. Suunto says a 500 error on the workout API usually means a bad workout key, which is a 12-byte hexadecimal string.
• 401 with "bad client credentials". Often a user trying Movescount credentials, or a malformed Basic header.
• Test on production data. Development runs against the production system, so testers' real Suunto data works; Suunto also publishes example FIT files.
• SuuntoPlus fields. Data from SuuntoPlus features sits in FIT files as developer fields.

The rest of the cluster is at how to integrate a fitness or health API.