Polar: register your app (AccessLink v3)

#Steps

1. Create or sign in to a Polar Flow account at https://flow.polar.com.

2. Go to https://admin.polaraccesslink.com and sign in with that account [OFF].

3. Create a new client [MEM: field names approximate]:

   • Application name: shown to members on consent.
   • Website / contact email: your company's.
   • Redirect URL / authorization callback: https://api.getlatido.com/connect/callback/polar.
   • Accept the AccessLink terms.

4. Copy the Client ID and Client Secret.

5. In Latido, Providers → Polar → Custom app: paste both and save, leaving the webhook secret empty (Polar issues it in the next step). Copy the webhook URL the dashboard now shows, https://api.getlatido.com/providers/polar/webhook/{providerAppId}.

6. Create the webhook. There is one per client and it is created through the API, not the admin site [OFF]. Polar checks the URL first: it sends an unsigned {"event":"PING"} and only creates the webhook if it gets a 200.

   bash

   curl -u "$POLAR_CLIENT_ID:$POLAR_CLIENT_SECRET" \
     -H "Content-Type: application/json" \
     -X POST https://www.polaraccesslink.com/v3/webhooks \
     -d '{"events":["EXERCISE","SLEEP","CONTINUOUS_HEART_RATE","ACTIVITY_SUMMARY"],
          "url":"<webhook URL from the dashboard>"}'

   If the dashboard offers a "Register webhook" action, use that instead.

7. The response carries signature_secret_key. It is shown once. Paste it into Latido as webhookSecret and save again. Until then Latido answers Polar's PING but rejects every notification. If you lose it, delete the webhook (DELETE /v3/webhooks/{id}) and create it again.

#Scopes

One scope, accesslink.read_all, requested in the authorize URL [OFF]. Nothing to tick.

#Going to production

No review step. Rate limits scale with users: 500 + 20 × users per 15 min, 5,000 + 100 × users per 24 h [OFF].

#Gotchas

• After the token exchange the member must be registered with POST /v3/users, or data calls fail with 403/404. Latido does this; it is why a connection can fail right after consent if the client is misconfigured.
• Tokens last about a year and there is no refresh token: when one expires, the member reconnects [OFF].
• Exercises are only listed for the last 30 days, so a backfill cannot go further back [OFF].
• A webhook that fails for 7 days is deactivated automatically [OFF]; reactivate with POST /v3/webhooks/activate.
• There is no documented revoke callback; a revoked member shows up as 401/403 (UNVERIFIED).

#Sources

• https://www.polar.com/accesslink-api/
• Open Wearables backend/app/services/providers/polar/