Browse the docs

Provider guide

Google Health: register your app (Fitbit's successor)
Access Google Cloud project + OAuth app. Every googlehealth.* scope is Restricted [OFF/OW]
Cost Free to start. Production needs an annual CASA security assessment by an authorised lab, about $500–4,500/year [OW docs citing Google]
Approval Brand + restricted-scope verification + CASA: plan 1–2 months [OW docs]
Until verified 100 users and 7-day refresh tokens ("Testing" status): members must reconnect weekly [OW docs]
Account A Google Cloud organisation on the company's Google Workspace domain is best; verification needs a verified domain you own [MEM]
Managed app Allowed by the catalog
Latido slug google_health (underscore)
Time ~10–15 minutes for a Testing app

Steps

  1. In https://console.cloud.google.com, create a project (e.g. "latido-google-health"). Note its project number (Dashboard → Project info).

  2. APIs & Services → Library: enable the Google Health API [OFF].

  3. OAuth consent screen (Google Auth Platform) [MEM: layout]:

    • User type External, publishing status Testing.
    • App name, support email, logo, app home page, privacy policy URL (it must describe Limited Use compliance), authorised domain = your domain.
    • Data access / scopes: add the scopes below.
    • Test users: add the Google accounts that will connect (max 100).

  4. Credentials → Create credentials → OAuth client ID → type Web application. Authorised redirect URI: https://api.getlatido.com/connect/callback/google_health. Copy Client ID and Client secret.

  5. In Latido, Providers → Google Health → Custom app: paste both, and set:

    • projectNumber: the project number from step 1.
    • webhookSecret: a long random string.

  6. Notifications (optional; Latido's catalog polls Google Health today): a project-level subscriber is created through the API, authenticated as a service account or your gcloud identity, not through the console [OW]:

    bash
    curl -X POST \
  "https://health.googleapis.com/v4/projects/$PROJECT_NUMBER/subscribers?subscriberId=latido" \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d '{"endpointUri":"<webhook URL from the dashboard>",
       "subscriberConfigs":[{"dataTypes":["exercise","sleep","steps","heart-rate","weight"],
                             "subscriptionCreatePolicy":"AUTOMATIC"}],
       "endpointAuthorization":{"secret":"Bearer <webhookSecret>"}}'

    Google first posts {"type":"verification"} with that Authorization header; Latido answers it with a 2xx [OW].

Scopes

All Restricted [OW]:

  • https://www.googleapis.com/auth/googlehealth.activity_and_fitness.readonly
  • https://www.googleapis.com/auth/googlehealth.health_metrics_and_measurements.readonly
  • https://www.googleapis.com/auth/googlehealth.sleep.readonly
  • https://www.googleapis.com/auth/googlehealth.nutrition.readonly (only if you need it)
  • https://www.googleapis.com/auth/googlehealth.settings.readonly
  • plus openid and email

Write scopes: UNVERIFIED (Google lists read & write data types for Q4 2026 [OFF]).

Going to production

  1. Brand verification of the consent screen.
  2. Restricted-scope verification: justification per scope and a demo video of the OAuth flow and where each data type is used [OW docs].
  3. An in-app prominent disclosure and a Limited Use privacy policy.
  4. CASA assessment (tier 2 or 3, about 2–6 weeks) by an authorised lab, renewed every year [OW docs].
  5. Switch publishing status to In production.

Gotchas

  • Members must have their Fitbit account linked to Google; otherwise calls return 400 ACCOUNT_NOT_LINKED [OFF].
  • In Testing, refresh tokens expire after 7 days [OW docs].

Sources