--- title: "How to Integrate the Wahoo Cloud API (2026)" canonical: "https://aifitnessapi.com/integrate/wahoo-api" cluster: "Integration Guides" primary_query: "wahoo api" last_reviewed: "2026-10-17" description: "Integrate the Wahoo Cloud API: request-based approval, OAuth with PKCE, the 10-token-per-user cap, workout summary webhooks, sandbox and production limits." publisher: "AIFitnessAPI — independent, not sponsored" cite_as: "\"How to Integrate the Wahoo Cloud API (2026)\", AIFitnessAPI, https://aifitnessapi.com/integrate/wahoo-api" --- # How to Integrate the Wahoo Cloud API (2026) > Wahoo's Cloud API connects Wahoo users to your app over OAuth 2.0 for profile data, power zones, plans, routes and workouts. Wahoo limits it to developers who request it: you register at developers.wahooligan.com, submit an app for approval, and production apps go through a further review for a higher rate limit. Access is currently free under Wahoo's Public API Agreement. Access tokens last 2 hours, apps are capped at 10 unrevoked tokens per user from January 1, 2026, webhooks deliver workout summaries, and Wahoo does not share workouts recorded in third-party apps. - Canonical: https://aifitnessapi.com/integrate/wahoo-api - Last reviewed: 2026-10-17 - Publisher: AIFitnessAPI (https://aifitnessapi.com) — independent, not sponsored - Cite as: "How to Integrate the Wahoo Cloud API (2026)", AIFitnessAPI, https://aifitnessapi.com/integrate/wahoo-api --- Wahoo's **Cloud API** connects Wahoo users to your app over OAuth 2.0 and covers profile data, heart rate and power zones, routes, plans and the upload and download of workouts. It is separate from Wahoo's iOS and Android APIs. Everything below is from Wahoo's developer portal, its live Cloud API documentation and its Public API Agreement, as read on October 17, 2026. If you are still choosing a provider, start with [wearable data APIs](/fitness-apis/wearable-data-apis). ## Access and approval | Question | What Wahoo's pages say | |---|---| | Who can use it? | Those who request it: Wahoo is "currently limiting use of the API to those who request it" and asks about the scopes involved and your app's purpose | | How do I apply? | Register at developers.wahooligan.com and submit an application; it shows as pending approval in your portal | | Sandbox or production? | Separate applications: a Sandbox app cannot later be converted into a Production app, so submit two if you need both | | What does production need? | A review by Wahoo Fitness; approved apps get a higher rate limit | | What does it cost? | The Public API Agreement says access is "currently provided at no charge", and Wahoo reserves the right to charge in future | The agreement adds terms worth reading before you build: you may not charge end users for access to Wahoo's API materials or anything included in them, though you can charge for functionality Wahoo does not provide, and you must attribute Wahoo using the links and logos it supplies. ## Auth and scopes Wahoo uses the OAuth 2.0 authorization-code flow, with PKCE available for public clients. Its base URL is `api.wahooligan.com`. ```http GET https://api.wahooligan.com/oauth/authorize ?client_id=YOUR_CLIENT_ID &redirect_uri=https://yourapp.example.com/callback &scope=user_read%20workouts_read%20offline_data &response_type=code ``` Exchange the returned `code` with a `POST` to `https://api.wahooligan.com/oauth/token` carrying your `client_id`, `client_secret`, the `code`, your `redirect_uri` and `grant_type=authorization_code`. For PKCE, set your app's "Confidential?" field to No in the portal, send a `code_challenge` (Wahoo accepts `plain` or `S256`) and pass the `code_verifier` on the token and refresh calls instead of the secret. The developer portal lists twelve scopes: `email`, `user_read`, `user_write`, `power_zones_read`, `power_zones_write`, `workouts_read`, `workouts_write`, `plans_read`, `plans_write`, `routes_read`, `routes_write` and `offline_data`. Two rules matter. Without `user_read`, Wahoo says the API returns 403. And `offline_data`, described as receiving data even when the app is closed, is required for webhooks. Request only what you use; Wahoo says applications must only request permission for resources they intend to access or modify. Tokens need care: - **Access tokens expire after 2 hours.** Refresh with `grant_type=refresh_token` to get a new access token and a new refresh token. - **Old tokens die on use, not on refresh.** The previous access and refresh tokens are revoked once an API call is made with the refreshed token. Refreshing alone does not revoke anything. - **A cap per user.** From January 1, 2026, an application is limited to 10 unrevoked access tokens per user, and unrevoked tokens are deleted automatically 60 days after creation. Wahoo's advice: refresh only immediately before an API request. - **File downloads do not count.** Downloading a FIT file from Wahoo's CDN is not an API request, so it does not revoke previous tokens. To disconnect a user, call `DELETE https://api.wahooligan.com/v1/permissions`. Portal flags can make that call, or a user revoking access from their account settings, also delete incomplete future workouts and the plans available to the user through your app. ## Data: workouts, summaries, plans, routes and zones | Resource | What it holds | |---|---| | Workouts | A single workout event; it becomes structured when it references a plan | | Workout summaries | The results of a completed workout, such as distance, duration and calories, with a link to its FIT file | | Workout file uploads | Upload a workout file and check its processing status | | Plans | Structured workout files with intervals and targets that play on Wahoo devices and apps | | Routes | Routes stored for the user | | Power zones | The user's power zones | | Users | The authenticated user's profile, readable and updatable | One limitation shapes what you can promise: **Wahoo does not share completed workout data that originates from third-party applications**, a change its changelog dates to April 1, 2025. A workout's `fitness_app_id` tells you the source: below 1000 is a Wahoo application, above 1000 a third party. Plans follow a library model, so create the plan once, then reference its ID from workouts; to show a plan on an ELEMNT bike computer it must be attached to a workout scheduled from today to six days out. The API returns decimal values as strings. ## Webhooks Configure webhooks per app with three settings: `webhook_enabled`, `webhook_url` and a `webhook_token` that Wahoo sends with each call so you can ignore anything without it. The documented event is `workout_summary`, which arrives as a JSON `POST` with the summary, the user's ID, the workout and a FIT file URL, and it requires users to have granted `offline_data`. If your endpoint does not return HTTP 200, Wahoo retries after 30 minutes, 4 hours, 24 hours and 72 hours. Duplicates are possible when files are updated or deleted, so make your handler idempotent. ## Rate limits Every response carries `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`, each listing the day, hour and 5-minute windows. The published limits: | Window | Sandbox apps | Production apps | |---|---|---| | Every 5 minutes | 25 | 200 | | Per hour | 100 | 1,000 | | Per day | 250 | 5,000 | Authentication, token refreshes and file downloads do not count against them. Wahoo asks you to contact support if you need more; a 429 means you are over. ## What changed recently | Date (Wahoo's changelog) | Change | |---|---| | October 9, 2026 | Documentation notes that scopes and other app settings can be changed on the Applications page of the portal | | October 6, 2025 | Wahoo Plans section, a Get Plans for Workout endpoint and multiple plans per workout (`plan_ids`) | | July 22, 2025 | Deauthorization features documented | | June 11, 2025 | `manual`, `edited` and `name` fields on workout summaries | | April 1, 2025 | Wahoo stopped sharing workout summaries created by third-party apps | | March 4, 2025 | Routes endpoint documented | The token cap of 10 unrevoked access tokens per user took effect on January 1, 2026. ## Gotchas and production notes - **Plan two apps.** Sandbox and Production are separate applications and a sandbox app cannot be promoted. - **Refresh late.** Refresh right before a call and use the new token at once, or you will pile up unrevoked tokens against the per-user cap. - **No third-party workouts.** Users who record in other apps will not see those workouts through Wahoo. - **Ask for `user_read` and `offline_data`.** One is needed to avoid 403s, the other for webhooks. - **Error 422 can mean "not approved".** Wahoo lists 422 for missing or invalid parameters or an app that is not approved. The rest of the cluster is at [how to integrate a fitness or health API](/integrate). ## Sources - [developers.wahooligan.com/cloud](https://developers.wahooligan.com/cloud) — API summary, request and approval, sandbox and production apps, scope list, agreement link (checked 2026-10-17) - [cloud-api.wahooligan.com/](https://cloud-api.wahooligan.com/) — registration, rate limits, OAuth and PKCE flows, token limits, deauthorization, resources, webhooks, errors, changelog (checked 2026-10-17) - [www.wahoofitness.com/wahoo-api-agreement](https://www.wahoofitness.com/wahoo-api-agreement) — no charge currently, right to charge, no charging end users for API access, attribution (checked 2026-10-17) ## FAQ ### Is the Wahoo API free? Yes, for now. Wahoo's Public API Agreement says access to and use of its API materials and platform are currently provided at no charge, and that Wahoo may charge in future. It also forbids charging your end users for access to Wahoo's API materials, though you can charge for functionality Wahoo does not provide. [Permalink](https://aifitnessapi.com/integrate/wahoo-api#faq-1) ### How do I get access to the Wahoo Cloud API? Register at developers.wahooligan.com and submit an application with details about your app's purpose and scopes; it shows as pending until Wahoo approves it. Sandbox and Production are separate applications and a sandbox app cannot be converted, so submit both if you need both. Production apps go through Wahoo's review. [Permalink](https://aifitnessapi.com/integrate/wahoo-api#faq-2) ### What is the Wahoo token limit? From January 1, 2026, an application can hold at most 10 unrevoked access tokens per user, and unrevoked tokens are deleted 60 days after creation. A refresh does not revoke the old token; only an API call with the new token does. So refresh immediately before a request, not on a timer. [Permalink](https://aifitnessapi.com/integrate/wahoo-api#faq-3) ### Does the Wahoo API have webhooks? Yes. Enable webhook_enabled, set a webhook_url and a webhook_token in your app settings, and Wahoo POSTs workout_summary events as JSON for users who granted the offline_data scope. Without an HTTP 200 it retries after 30 minutes, 4 hours, 24 hours and 72 hours, and duplicates are possible. [Permalink](https://aifitnessapi.com/integrate/wahoo-api#faq-4) ### What are the Wahoo API rate limits? Sandbox apps get 25 requests every 5 minutes, 100 an hour and 250 a day; production apps 200, 1,000 and 5,000. Authentication, token refreshes and file downloads do not count, every response reports usage in X-RateLimit headers, and Wahoo raises limits on request through support. [Permalink](https://aifitnessapi.com/integrate/wahoo-api#faq-5)