The fitness API openness index

You set up and manage your own client on the API Keys page.

To use it, you’ll need to set up an API key on the "API Keys" page. There, you can set up and manage your own client and get the client information needed to authenticate users using OAuth.

A development server and database at log-dev.concept2.com.

Applications requesting write permissions should be set up on log-dev.concept2.com .

The developer pages read state no price.

Concept2 says the API is not currently rate limited, that this may change, and that abuse will bring rate limits or removal of access.

The API is not currently rate limited. This may change in the future. Abuse of the API will result in either rate limits or removal of access.

Concept2 has a webhook for results added, updated or deleted; the pages read describe no signature.

Through your self-service developer portal, you can register and manage a webhook that will fire when a relevant result is added, updated, or deleted.

Not mentioned on the Logbook API pages read.

Every application gets the authorization-code and refresh grants.

All applications have access to the Authorization Code and Refresh grant types.

DELETE on a result deletes that workout.

DELETE api/users/me/results/123 will delete a specific workout

Partner API access is by application: a form and an email to COROS.

To apply, submit your platform details using the form below and email

The help-center articles read name no sandbox or test environment.

The help-center articles read state no price.

1,000 per minute.

Rate limit: 1,000 calls/minute

COROS lists webhook push in its Partner API but the articles read show no payload or signature.

Not mentioned in the help-center articles read.

The Partner API's OAuth 2.0 list includes refresh.

OAuth 2.0 (authorize, access token, refresh, deauthorize, bind state)

The Partner API lists a deauthorize call.

OAuth 2.0 (authorize, access token, refresh, deauthorize, bind state)

Registration is free and gives you app credentials.

Registration is simple and free, however, and provides access to app credentials and Support Requests .

A sandbox environment at sandbox-api.dexcom.com with sandbox users.

To target the sandbox environment, use https://sandbox-api.dexcom.com as the base URL for requests.

Registration is free; the pages read state no price for full access, which follows a technical and commercial review.

Once application is complete, Dexcom will setup a technical and commercial review of your app.

60,000 per hour.

Request frequency is limited to 60,000 calls per app per hour. If the limit is exceeded, an HTTP 429 response is returned.

Dexcom's webhook documentation was not among the pages read.

Not mentioned. Dexcom also requires tokens and the client secret to live on your server, not on a phone.

Each refresh token works once and is replaced by a new one; each lasts at most a year. A 400 on refresh means it is no longer valid: send the user through login again.

Each refresh_token can be used only once.

Users can revoke access on Dexcom.com; the pages read name no API call for it.

Users can revoke their authorization at any time at Dexcom.com by signing in to their account and changing their authorizations in Permissions.

Access starts with a request Garmin approves.

After you request access to the Garmin Connect Developer Program and your request has been approved, you will be granted access to the Garmin Developer Portal and can get started on your integration right away.

An evaluation environment for testing, after approval.

After approval, you will have access to an evaluation environment to test the Garmin Connect Health API.

Enterprise terms are tailored; the current program pages read state no Starter price.

Designed for companies operating at scale requiring capabilities beyond Starter Access. Available options and commercial terms are tailored based on business and technical requirements.

Garmin's public program pages publish no request limits; the overview gives Starter a "Limited" user capacity without a number.

Push only Historical Data Not included User Capacity Limited

No public Garmin page read shows a push payload or how it is signed.

Garmin's OAuth reference was not among the pages read; the program FAQ says only that the APIs use OAuth 2.0.

Garmin's OAuth reference was not among the pages read.

The program pages read name no deregistration or deletion call.

A new OAuth client works unverified, capped at 100 users.

By default, newly created OAuth clients are in an unverified state with a cap of 100 users for both testing and production purposes.

The unverified state is the same for testing and production; the pages read name no separate sandbox.

The pages read state no price for the API.

Default quotas, per project (daily): 86.4M requests / day; per project (minutely): 120,000 requests / minute; per user (minutely): 300 requests / minute.

300 requests / minute

Google sends the endpointAuthorization secret you configured in the Authorization header. It also signs the raw JSON with Tink (ECDSA P-256, SHA-256), base64 in GOOGLE-HEALTH-API-SIGNATURE, keys rotated every 30 days and published as a JSON keyset.

the raw JSON payload of every outgoing webhook notification is signed with a private key using Tink's PublicKeySign

Not described on Google's web-server OAuth page, which the OAuth playground follows.

access_type=offline gets a refresh token on the first exchange only. Refresh tokens last until revoked or expired, and Google caps how many it issues per client and user.

Refresh tokens are valid until the user revokes access or the refresh token expires.

batchDelete deletes a user's data points.

Use the `batchDelete` method to delete an array of a user's Fitbit app data.

A new app works for up to 10 users; Oura's approval is needed beyond that.

By default, API Applications have a ten user limit. If you want to release your application to a wider audience, your application needs to be approved.

A sandbox endpoint with fake data for every data type.

Fake user data that you can access without an Oura account. There is a corresponding sandbox endpoint to each available data type.

Free for personal and commercial applications.

Yes, the Oura API is free to use for both personal and commercial applications.

5,000 per 5 minutes.

The Oura API is limited to 5000 requests per 5-minute period.

HMAC-SHA256 keyed by your client secret over the x-oura-timestamp value followed by JSON.stringify(body), hex, upper-case, in x-oura-signature.

hmac.update(timestamp + JSON.stringify(body));

Recommended. code_challenge_method must be S256; the verifier is 43 to 128 characters, hashed with SHA-256 and base64url-encoded without padding.

between 43 and 128 characters long (inclusive), then hash it with SHA256 and encode the digest in base64url format without padding

grant_type=refresh_token at the token URL returns a new access token and a new refresh token; each refresh token works once.

The refresh token is single-use, meaning it is invalidated after being used.

A token revocation endpoint.

https://api.ouraring.com/oauth/revoke?access_token={access_token}

Any registered Polar Flow user can create an API client.

Any registered Polar Flow user can create API client to AccessLink by filling application details at https://admin.polaraccesslink.com

The AccessLink reference read names no sandbox or test environment.

Free of charge at the moment; Polar reserves the right to charge.

At the moment Polar offers the use and activation of Polar API's free of charge.

500 + 20 per user per 15 minutes; 5,000 + 100 per user per 24 hours.

15min rate limit: 500 + number of users x 20

HMAC-SHA256 of the payload, keyed by the signature_secret_key returned once when you create the webhook, hex, in Polar-Webhook-Signature; the event type is in Polar-Webhook-Event.

Hash-based message authentication code (HMAC SHA-256) is used to sign every webhook payload Accesslink sends.

Not mentioned on the AccessLink reference.

No refresh flow is documented: the token response lists no refresh_token, and the reference says access tokens do not expire unless revoked.

Access tokens will not expire unless explicitly revoked by partners or users.

Deregistering a user revokes the token.

When partner wishes no longer to receive user data, user can be de-registered. This will revoke the access token authorized by user.

Any registered Strava user can create an application.

Any registered Strava user can obtain an access_token by first creating an application at https://www.strava.com/settings/api .

New apps start in single-player mode, to build and test against your own data.

All new applications start in single-player mode. This is the default state where only your own Strava account can authenticate with the app, which lets you build and test your integration against your own data.

Currently at no charge.

Access to and use of the Strava API Materials and the Strava Platform are currently provided at no charge.

100 non-upload, per 15 minutes; 1,000 non-upload, per day; 200 overall, per 15 minutes; 2,000 overall, per day (New app (default); 2 tiers published).

rate limit allows 100 requests every 15 minutes, with up to 1,000 requests per day.

No signature is documented for event POSTs. Subscription validation is a GET with hub.mode, hub.challenge and hub.verify_token; echo hub.challenge as JSON.

The query string of this GET request will contain a "hub.challenge" field that you must use to validate your callback address.

Not mentioned on Strava's Authentication page.

Refresh with grant_type=refresh_token. If the current access token expires in more than an hour, the same one comes back; once a new refresh token is returned the old one stops working.

Once a new refresh token is returned, the older refresh token is invalidated immediately.

Deauthorizing invalidates every token the app holds for the athlete.

Applications can revoke access to an athlete’s data. This will invalidate all refresh tokens and access tokens that the application has for the athlete

Applications are reviewed weekly; the wait is up to two weeks.

The applications are reviewed on weekly bases, so you have to wait few days prior getting the acceptance. There is maximum two week waiting period.

A Development API with every endpoint and smaller request limits.

The Development API includes all the endpoints but has smaller request limits.

Suunto does not charge for the API.

We do not charge from the use of the API.

Suunto says the developer API is rate-limited and has smaller limits than production, but publishes neither number.

There developer API has same capabilities as the production API. However, the number of calls you can do with developer API are rate-limited.

Not documented on Suunto's FAQ. The webhook address is set in your app's OAuth settings in Suunto API Zone and must be publicly reachable.

You can setup the webhook in your app oauth settings under your profile in Suunto Apizone

Not mentioned on Suunto's quick-start or FAQ.

The token response includes a refresh_token, but the pages read here document no refresh request, so the OAuth playground prints none.

"refresh_token": "<JWT_REFRESH_TOKEN>"

The API Zone pages read name no deauthorization or deletion call.

The pages read describe the dashboard's credentials but not whether a new account is reviewed.

Testing and staging environments, each capped at 50 users.

Note that for testing & staging, there is a user limit of 50 users on each environment.

Published plans from $399 a month billed annually.

Subscriptions start from $399 per month billed annually, or $499 per month billed monthly. That includes 100,000 Unified API credits each month, and you only pay extra if your usage goes beyond them.

6,000 requested days per hour, per user.

your code has issued requests for this user totalling more than 6,000 days in the current hour

terra-signature: t=<timestamp>,v1=<signature>; HMAC-SHA256 keyed by the webhook's signing secret over the timestamp, a "." and the raw body. Ignore schemes other than v1.

Compute an HMAC with the SHA256 hash function. Use the endpoint’s signing secret as the key, and use the signed_payload string as the message.

Your server calls Terra with a dev-id and an API key; the pages read describe no OAuth client on your side.

dev-id string Required Your developer ID for authentication and tracking

Your server calls Terra with a dev-id and an API key; the pages read describe no OAuth client on your side.

dev-id string Required Your developer ID for authentication and tracking

Terra sends a deauth event when a user disconnects; the pages read name no call your app makes for it.

deauth Occurs when a user deauthenticates through the Terra

Wahoo limits the API to those who request it.

Wahoo Fitness is currently limiting use of the API to those who request it, as well as provide more information about the scopes involved and the purpose of the application.

Sandbox and Production are separate applications.

Sandbox and Production are separate applications. A Sandbox app cannot later be converted into a Production app.

Currently at no charge; Wahoo reserves the right to charge.

Access to and use of the Wahoo API Materials and Wahoo Platform are currently provided at no charge.

25 per 5 minutes; 100 per hour; 250 per day (Sandbox; 2 tiers published).

Requests every 5 Min: 25 200

No signature. Wahoo sends the webhook_token you set in the app's webhook settings inside the JSON body; ignore any request without it.

Specify a token that you would like us to send. Any request that doesn't include this token should be ignored.

Supported once the app's Confidential field is set to No; S256 or plain. With PKCE the token and refresh calls send code_verifier instead of client_secret.

The Wahoo API does allow users to use the PKCE flow for authorization.

Refresh returns a new access and refresh token. The previous pair is revoked only when an API call uses the new access token, so refresh just before a request: apps are limited to 10 unrevoked tokens per user.

Access tokens should only be refreshed immediately prior to making an API request.

DELETE /v1/permissions deauthorizes the user.

DELETE https://api.wahooligan.com/v1/permissions

Build and test on the 10-member Sandbox tier without a request.

Every new app starts on the Sandbox tier, which allows up to 10 WHOOP members to connect. You can build and test on Sandbox without submitting a request. When you need more members, request the next tier from the Developer Dashboard .

Every new app starts on the Sandbox tier.

Every new app starts on the Sandbox tier, which allows up to 10 WHOOP members to connect.

Currently at no charge, with notice before that changes.

Access to and use of the APIs is currently provided at no charge. In the event WHOOP decides to start charging for use of the APIs in the future, WHOOP will provide Company with prior notice.

100 per minute; 10,000 per day.

All clients are subject to two sets of rate limiting for requests. By default, clients may only send: 100 requests per minute. 10,000 requests per day.

Base64 of HMAC-SHA256, keyed by your client secret, over the X-WHOOP-Signature-Timestamp value (milliseconds since epoch) followed by the raw body, in X-WHOOP-Signature.

calculated_signature_string = base64Encode(HMACSHA256(timestamp_header + raw_http_request_body, client_secret))

Not mentioned on the WHOOP OAuth page or API reference read here.

Using the refresh token invalidates the existing access tokens; the refresh token in the response replaces the old one, and of two simultaneous refreshes only the first succeeds.

Existing access tokens are invalidated once your app uses the refresh token to generate a new access token.

The revokeUserOauthAccess endpoint.

To revoke an access token, you can use the revokeUserOauthAccess API endpoint.

No prerequisites to get access.

There are no prerequisites, and free access is provided.

mode=demo signs in a demo user.

you can use the optional parameter mode with the value demo . You will be redirected to the authorisation page and automatically logged in as a demo user.

Free access on the public API.

There are no prerequisites, and free access is provided.

120 per minute.

The standard Withings API enforces a 120 requests-per-minute limit across your application

No body signature. Append a secret query parameter to the callback URL (Withings' example: ?token=<random-secret>) and check it, plus an allowlist of the IP ranges Withings publishes as DNS TXT records.

Your handler reads token from the incoming request and rejects any value that doesn't match the secret you configured.

Not mentioned on the Withings authorization or token pages.

Withings says to call the same requesttoken service with the refresh token and always keep the new refresh token, but its snippet shows only the code exchange, so the OAuth playground prints no refresh command rather than guess its parameters.

To request a new access_token using the refresh_token, call the requesttoken webservice

The developer-guide pages read name no revoke or deletion call.