Browse the docs

Provider guide

Wahoo: register your app (Cloud API)
Access Sandbox app first; Wahoo reviews the move to production [OFF]
Cost No fee found (UNVERIFIED)
Approval UNVERIFIED
Account A Wahoo developer account; company details for the production review
Managed app Allowed by the catalog
Latido slug wahoo
Time ~10 minutes
Writes The strongest of all providers: plans (structured workouts), scheduled workouts, routes, power zones [OFF]

Steps

  1. Sign up at https://developers.wahooligan.com and create a new application [OFF: portal; MEM: field names].
  2. Fill the form:
    • Name, description, logo.
    • Redirect URI: https://api.getlatido.com/connect/callback/wahoo.
    • Confidential client: yes (Latido keeps the secret server-side, so no PKCE needed) [OFF].
    • Scopes: tick the ones below.
  3. Copy Client ID and Client Secret.
  4. In Latido, Providers → Wahoo → Custom app: paste both, set webhookToken to a long random string, save, and copy the webhook URL https://api.getlatido.com/providers/wahoo/webhook/{providerAppId}.
  5. Back in the Wahoo app settings [OFF]:
    • webhook_enabled: on.
    • webhook_url: the webhook URL.
    • webhook_token: the same value as webhookToken. Every push carries it and Latido compares it.

Scopes

user_read workouts_read offline_data at minimum: user_read is required (else 403) and offline_data is required for webhooks [OFF]. Add plans_read plans_write workouts_write to push planned workouts, and routes_read routes_write power_zones_read if you use them.

Going to production

Sandbox limits are tight: 25 requests/5 min, 100/hour, 250/day. Production (200/5 min, 1,000/hour, 5,000/day) requires Wahoo's review [OFF].

Gotchas

  • Access tokens last 2 h; the old pair is revoked only once the new access token is used [OFF].
  • From 1 Jan 2026, max 10 unrevoked tokens per user: refresh only right before a call [OFF].
  • Retries after 30 min, 4 h, 24 h and 72 h; duplicates are possible [OFF].
  • Portal flags can delete a member's future workouts and plans on deauthorization; check them [OFF].

Sources