Browse the docs

Provider guide

Withings: register your app
Access Self-serve, no partner review [OW]
Cost Free up to 1,000 active users and the Basic Biomarker Pack; paid plans above that and for skin temperature, PWV, VO2max, sleep HRV and automatic SpO2 [OW docs]
Account Any Withings account works; a company email is better because the app belongs to whoever creates it
Managed app Allowed by the catalog
Latido slug withings
Time ~10 minutes

Before you start

  • Nothing on your side: Latido's API (https://api.getlatido.com) is public HTTPS, which Withings requires (it refuses localhost and IP addresses for both the callback and notifications [OW]).
  • The provider app saved in Latido first, so you have its webhook URL.

Steps

  1. Go to the Withings developer portal, https://developer.withings.com, and sign in (or create a Withings account) [OFF].
  2. Open the developer dashboard and create a new application for the Public API (the standard OAuth integration, not "dropship" / user creation) [MEM: menu names may differ].
  3. Fill the form [MEM: field names approximate]:
    • Application name: your product name, as members will see it on the consent screen.
    • Description: one line on what you do with the data.
    • Contact email: a monitored address.
    • Callback URL(s): the redirect URI from the Latido dashboard, https://api.getlatido.com/connect/callback/withings. HTTPS, public hostname.
    • Logo: optional but shown on the consent screen.
  4. Save. Copy the Client ID and Client Secret (Withings may call the secret "Consumer Secret").
  5. In Latido, open Providers → Withings, choose Custom app, paste client id and secret, and save.
  6. Settings to fill in Latido:
    • webhookSecret: any long random string (e.g. openssl rand -hex 32). Withings does not sign notifications, so Latido puts this secret in the notification URL query and rejects calls without it [OW].
  7. Nothing to paste for the webhook in the Withings portal: notifications are per user. After each member connects, Latido calls POST /notify action=subscribe with that member's token and the callback URL https://api.getlatido.com/providers/withings/webhook/{providerAppId} [OW]. Withings sends a HEAD request to the URL first; Latido answers it.

Scopes

Requested by Latido in the authorize URL, comma-separated [OW]: user.info,user.metrics,user.activity and, for bed in/out events, user.sleepevents. There is nothing to tick in the portal.

Going to production

  • There is no separate review. The free plan is limited to 1,000 active users and 120 requests/minute app-wide; paid plans raise both (1,500+ req/min) [OW docs].
  • An app with no compliant notification URL is capped at 10 linked users [OW docs]. Make sure the HEAD check succeeds.

Gotchas

  • Every API response is an envelope {status, body}. status != 0 is an error even with HTTP 200 [OW].
  • The member revoking access arrives as notification appli=46 with action=delete|unlink [OW]; there is no separate deauthorization webhook.
  • Token lifetimes (~3 h access, ~1 year rotating refresh) are [MEM].

Sources