Browse the docs

Provider guide

Strava: register your app
Access Self-serve at strava.com/settings/api [OFF]
Cost Since 1 Jun 2026 the Standard tier requires the developer to hold a paid Strava subscription (new developers from 1 Jun, existing from 30 Jun 2026); Extended Access is exempt [2ND]
Account A personal Strava athlete account: the app belongs to that athlete. One app per account [MEM]
Managed app No: bring your own keys. Strava's 2026 terms refuse intermediaries
AI use Forbidden. Strava data never reaches Latido's MCP
Latido slug strava
Time ~10 minutes

Terms that matter (read before registering)

API Agreement effective 1 Jun 2026:

  • A user's data can be displayed only to that user, never to other users, even if their activities are public [OFF].
  • No sharing with third parties without explicit consent; no competing products; Strava may introduce fees [OFF].
  • Apps that route data through third-party intermediary platforms are no longer supported [2ND]. Latido is such a platform, which is why the catalog marks Strava custom_only: each customer registers their own app and answers to Strava for it.
  • The AI ban covers training and, reportedly, context-window ingestion, RAG, embeddings and running MCP servers or agents over Strava data; caching is limited to 7 days [2ND].
  • A unified API that re-serves Strava data to B2B customers is very likely non-compliant. Get written confirmation from Strava before selling it.

Steps

  1. Sign in to Strava with the account that will own the app and make sure it has an active subscription (see Cost).

  2. Go to https://www.strava.com/settings/api and create an application [MEM: field names]:

    • Application name and Category.
    • Club: leave empty.
    • Website: your company website.
    • Application description.
    • Authorization Callback Domain: the host only, no scheme or path: api.getlatido.com. Strava then accepts https://api.getlatido.com/connect/callback/strava [OFF: callback is matched on domain].
    • Upload an icon (required before the keys appear) [MEM].

  3. Copy Client ID and Client Secret.

  4. In Latido, Providers → Strava → Custom app: paste both. Set webhookVerifyToken to a long random string. Save.

  5. Create the webhook subscription (one per app; Latido may do this for you when the app is saved; otherwise run it yourself). Latido answers the handshake: Strava calls the URL with hub.challenge and needs the answer within 2 s [OFF].

    bash
    curl -X POST https://www.strava.com/api/v3/push_subscriptions \
  -F client_id="$STRAVA_CLIENT_ID" \
  -F client_secret="$STRAVA_CLIENT_SECRET" \
  -F callback_url="<webhook URL from the dashboard>" \
  -F verify_token="<the webhookVerifyToken you set>"

    Check it with GET /push_subscriptions?client_id=…&client_secret=….

Scopes

Requested in the authorize URL (comma-separated), not ticked in the portal [OFF]: read,activity:read_all,profile:read_all. activity:read is the minimum for activity webhooks. Members can untick scopes on the consent screen; Latido reads the granted scope on the callback.

Going to production

  • A new app starts with a small athlete capacity: Standard tier up to 10 connected athletes [OW docs]; Strava's own page may show 1 at first (UNVERIFIED). More requires the Extended Access review.
  • Rate limits: Standard 200 req/15 min and 2,000/day; Extended 400 and 4,000 [OW docs].

Gotchas

  • Refreshing may return a new refresh token and invalidate the old one at once [OFF].
  • Webhooks carry ids only; Latido refetches. A member deauthorizing arrives as object_type=athlete with updates.authorized="false" [OFF].
  • Strava documents no webhook signature [OFF], so the only checks available are the unguessable URL and the event's subscription_id. Whether the X-Strava-Signature header OW reads really exists is UNVERIFIED.
  • Use /oauth/revoke (new from 1 Jun 2026); /oauth/deauthorize is removed 1 Jun 2027 [OFF].
  • No original FIT download: streams only [OFF].

Sources