Browse the docs

Provider guide

Suunto: register your app (Cloud API, API Zone)
Access Partner program, companies or organisations only; no personal-use access [OFF]
Cost No fee found (UNVERIFIED)
Approval About 2 weeks, plus signing an API agreement [OFF]
Account Company account on API Zone, company email
Managed app Allowed by the catalog
Latido slug suunto
Time ~10 minutes to apply

Steps

  1. Read https://apizone.suunto.com/how-to-start and sign up on API Zone (https://apizone.suunto.com) with your company email [OFF].
  2. Apply for partner access: company name, website, what you build, expected users [MEM: exact fields]. Wait for Suunto's review and the API agreement (~2 weeks).
  3. After approval, in API Zone:
    • Subscribe to the API product. Your profile then shows a subscription key (primary/secondary). Every API call needs it in the Ocp-Apim-Subscription-Key header [OFF].
    • Get the OAuth client id and client secret Suunto issues for your app [OFF].
    • Register the redirect URI: https://api.getlatido.com/connect/callback/suunto.
  4. In Latido, Providers → Suunto → Custom app: paste client id and secret, and set:
    • subscriptionKey: the API Zone subscription key.
    • webhookSecret: the notification secret (next step). Save and copy the webhook URL https://api.getlatido.com/providers/suunto/webhook/{providerAppId}.
  5. In the API Zone portal (there is no API for this [OW]), set the notification URL to that webhook URL and copy (or set) the notification secret into webhookSecret. Suunto signs pushes with X-HMAC-SHA256-Signature = HMAC-SHA256(secret, raw body) [OW].

Scopes

Default scope workout; the authorize URL normally omits it [OFF/OW]. Nothing to tick.

Going to production

  • The developer tier is 10 calls/minute and 200 calls/week [OW docs]: enough to test with a handful of members, not to backfill many. Ask Suunto for a higher tier before launch.

Gotchas

  • Suunto pushes data inline (workouts, 24/7 sleep, activity, recovery, routes) and expects a response within 2 s [OW].
  • Access tokens last 24 h; refresh with grant_type=refresh_token [OFF].
  • No documented deauthorization callback (UNVERIFIED).

Sources