How to Integrate the TeamUp API (2026)

TeamUp sells management software for fitness studios, boxes and gyms, and publishes one REST API for the business data in it. This guide is written from TeamUp's developer documentation at docs.goteamup.com as it stood on October 17, 2026: the introduction, getting-started guide, authentication and errors pages, rate limits, FAQ and API Terms of Use.

Still choosing a platform? Our gym and studio management software API comparison puts TeamUp next to Mindbody, Mariana Tek, Wodify and ABC Glofox.

What the API is#

TeamUp's introduction calls it "a full-featured API to interact with your TeamUp business" that can "power custom websites or apps for your business, or allow automations for your business". It is organized around REST, uses resource-oriented URLs, accepts and returns JSON, and uses standard HTTP response codes. Every endpoint is relative to one base URL:

https://goteamup.com/api/v2

The FAQ adds two warnings worth pinning to your config file. There is no api.goteamup.com subdomain, and URLs built on it "have never existed". And v2 replaced the older pair of APIs: TeamUp moved "from two parallel APIs (Customer vs Business) to a single unified API", where what you can see and do depends on who you are authenticated as, not which URL you call.

The FAQ also says the v2 API is the same API TeamUp's own web and mobile apps use, so external developers get the same functionality.

Access: the business creates an Application#

The first step is to create an API Application, which TeamUp describes as representing the system you're integrating: a custom website, an app or a back-office automation. The Application sets limits on what the integration may do, can generate access tokens for your users, and leaves a reporting trail, because the business dashboard shows which registrations and other actions your Application performed.

Who can do that, per TeamUp's FAQ:

• Staff with the super admin permission. Applications are created and managed by staff members with the super admin permission at the business, typically the owner, directly in the business dashboard.
• No fee, no paid plan. There is no extra fee for API access, and free trial accounts can create API Applications too.
• No sandbox. There is no separate sandbox environment. TeamUp's advice is to sign up for a free trial and use it as a test business.

In our reading, that makes TeamUp the most open model among the studio platforms we checked: a business can switch the API on for itself, the same day, without a partner application. Our recommendation if you are an outside developer building for a TeamUp business: ask its super admin to create the Application, and agree up front which credential type you will use.

Authentication: three methods, three kinds of credential#

TeamUp supports three ways to authenticate, and it is emphatic that their credentials are not interchangeable:

Every authenticated request carries its credential in the HTTP Authorization header with the Bearer prefix:

curl "https://goteamup.com/api/v2/events?page_size=5" \
  -H "Authorization: Bearer YOUR_M2M_TOKEN"

Points from TeamUp's authentication page that save debugging time:

• No static API keys. TeamUp does not support the OAuth client_credentials grant or static API keys; its token endpoint only accepts grant_type=authorization_code. If you want an "API key" for server-to-server access, an M2M token is the supported equivalent.
• The client secret never goes in the header. The client ID and secret you see when you create the Application are only used as parameters in the OAuth flow. TeamUp says sending the wrong credential is "the most common integration mistake we see".
• Two different 401s. A missing or malformed Bearer prefix makes the API treat the request as unauthenticated, which surfaces as authentication_failed ("Incorrect authentication credentials."). A message that the token is expired or invalid usually means a client secret was pasted where a token belongs, or the token was revoked or expired.
• Direct Authentication is gated. Because your app would handle user passwords, TeamUp only enables it after reviewing your use case, and then issues a secondary secret for the Password Login endpoint.

Request mode and provider headers#

With an OAuth token, what your integration can do depends on the authenticated user's role and permissions. An M2M token always acts in provider (staff) mode with admin permissions. Two headers resolve ambiguity:

• TeamUp-Request-Mode (provider or customer) is only needed when an OAuth identity is both a customer and a staff member.
• TeamUp-Provider-ID names the business a request acts on when your credentials reach more than one, as with franchises and multi-location businesses.

Your provider ID is the number at the start of the business's Customer Site URL. You can also call GET /auth/application, whose scoped_providers field lists the provider IDs your credentials can access.

Rate limits and errors#

Unless an endpoint says otherwise, TeamUp allows 250 requests per minute per caller, where the caller is the authenticated user, or the IP address for unauthenticated endpoints. Exceed it and you get HTTP 429. TeamUp recommends retrying with exponential backoff and using the expand parameter to fetch related data in one request rather than several.

Errors use conventional status codes and a JSON body with a code, a message, a type and, for validation problems, per-field field_errors. The code string is the one to branch on in your handler.

Webhooks#

TeamUp's getting-started guide lists receiving event notifications with webhooks as a next step, and its authentication page names "a webhook processor that receives TeamUp event notifications" as a typical use for an M2M token. The webhook pages themselves were not among the pages we read, so check event names and delivery behavior in TeamUp's webhooks guide before you build on them.

API terms in brief#

TeamUp's API Terms of Use were last updated July 11, 2025. They let TeamUp limit API calls in any period and, if you exceed the limits, charge fees or end your access. They also bar sharing access with competitors, using data for unauthorized purposes and publishing metrics about the API, and let either side end the arrangement, TeamUp at any time and you with 90 days' notice. This is general information, not legal advice.

For the patterns this API leans on, see how OAuth works for health and fitness data and webhooks versus polling. The rest of the cluster is at how to integrate a fitness or health API.