Developers & API

(I’ve read the relevant posts on here but did not find the answers I seek there)Hi all,New to oauth2, building an app that needs to read activity data from Strava. For this, I need activity:read in my permission scope. However, I can only get the “read” scope despite choosing scope arg as “activity:read” or “read, activity:read”. I can see that the token generated only has “read” permission on the API app dashboard on my profile, and I also see an authorization error when I invoke the read activities API. Here is my code: REDIRECT_URI = "https://localhost:8501"AUTHORIZE_URL = "https://www.strava.com/oauth/authorize"TOKEN_URL = "https://www.strava.com/api/v3/oauth/token"SCOPE = "activity:read"API_BASE = 'https://www.strava.com/api/v3' auth_url = f"{AUTHORIZE_URL}?client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}&response_type=code&scope={SCOPE}" I exclude the client id and secret of course, and the rest of the code that creates a link on my dashboard to auth_url. This genera

Hello all,  In our cotacol (Belgian) app, we are leveraging Strava Segments so our members can "collect" different hills in Belgium.  Those hills match one:one with a Strava Segment.  Now, I am building a functionality, so that users can select one of their Routes and get to see which of the 1000 segments that would be conquored with that Route... However, just like the default behavior with an activity, it seems not all the routes are returned in the response for a Strava Route.  And I am wondering if there is a similar query string parameter we can use, to indicate we need all segments in the response.  (just like include_all_efforts with the GetActivity operation). What I am doing now:  - GET /routes/{routeId} This only returns a subset of the segments in the payload.    

why i have two api app with same clientId, and cant remove one of them, it confuse me bcs sometimes the app that shows in dashboard is the first one sometimes the other

Relatively new to this, so hopefully an easy mistake to fix: I am trying to set up an API connection so I can fetch my own data from Strava and import it to Excel. I am following the usual set-up as described here : https://developers.strava.com/docs/getting-started/#oauthAlthough I have tried the final authorization time and time again, it keeps saying my acces token is invalid. I have followed the steps multiple times. The token is not expired either, but it keeps giving me errors. I have checked step C4 and C5 in Postman. That does not give me errors. But when attempting D10/D11, I get either 404 errors (although im sure my website is correct) or 401 errors. I also notice that my acces token in step C4/C5 differs from the oneAny idea’s on how to solve this? 

Since last week I noticed that the all_*_totals (eg. all_run_totals) have reset on the API to start counting from 0 even though the Strava Portal clearly indicates a much higher number.  On Strava portal my all time running stats are 113However the API https://developers.strava.com/docs/reference/#api-Athletes-getStats no returns only my most recent run count"all_run_totals": { "count": 1, "distance": 5630.0, "moving_time": 2473, "elapsed_time": 2519, "elevation_gain": 86.63724517822266}, How do I get this corrected?

Hello,I’m trying to find an API endpoint to get my best effort times on different run distances (1K, 5K, HM etc.), but I can’t find a sensible way to do it. I understand that I could, in theory, go through each detailed activity, but that would be a hassle. There must be a more efficient way of doing this? 

Can anyone help me understand why some segments appear to return segment efforts via API, and others do not?  Using the same query, changing only the segment ID, one segment returns efforts and another does not. When I view in the web UI, e.g. https://www.strava.com/segments/1234, I can see a recent effort (definitely within the time range).  Both activities are Followers Only, both are marked “downhill”, and I am properly authenticated.  I cannot tell any other important differences.  The only thing I can think of is that I have only done the segment that doesn’t work once, whereas the one that works I’ve done numerous times.What’s more, if I manually find the activity view the web UI, and query /api/v3/activities/4321, I am able to see the segment effort contained in that JSON response.  Any help appreciated.  Thanks in advance! curl "https://www.strava.com/api/v3/segment_efforts?segment_id=$SEGMENT_ID&per_page=1&page=1&start_date=2000-01-01T00:00:00&end_date=2025-06-

Hello there,I’m currently working on webhook integrationAn existing webhook subscription is still active under this application, but it points to an outdated callback URL which is no longer online. As a result, any attempt to delete the subscription via the DELETE /push_subscriptions endpoint returns a 404 error.Is there a way to force-remove or to override a no-longer used subscription? The server to which the url points is no longer running since a while.Thanks a lot in advance for your help

https://developers.strava.com/docs/reference/#api-models-DetailedActivity states that a `best_efforts` field should be returned. Presumably this would be a subset of the `segment_efforts` collection, but I am not seeing it returned in any queries in order to verify this assumption. What are the conditions that result in an activity returning the `best_efforts` field? Is it a subset of `segment_efforts`? Or is it something else? The docs should be updated with this information.

Why does this rogue app called “a” appear in My Apps? It leads to a website of script-kiddy programmers who dabble in various LLMs.Who owns this app “a”?  When I revoke access, and change my password, it reappears anyway after up to one hour. See screenshot:The website this app links to is not a website I use, is not a professional website, and is six LLM programmers at university.  I don’t understand what is going on. Surely Strava aren’t using these guys for LLM processing? My account is not compromised and password has not been given to anybody. I do not use these LLM services. Thanks.

Is this issue happening to everyone?  Every request is returning a placeholder image.https://d3nn82uaxijpm6.cloudfront.net/assets/media/placeholder-photo@4x-6c5d2aaeadca1292be72943c04ea6defe7dcd610da7dc87a1ccaad30e134b2d6.png

According to the current Webhooks Events API documentation, only the client authenticates to Strava upon subscription registration/check, with the API client_id and client_secret.This is great but IMO insufficent, as both parties should somehow be authenticated. In other words, Strava should authenticate with the Webhook suscriptor. The way is done at the moment, an attacker could impersonate Strava's API sending fake event data to the client's endpoint. The only way the client could defend from this would be checking whether if the subscription ID matches or not. But this is neither proposed as a security measure in the documentation site, or implicit within the process (it's something that the clients would need to implement ad-hoc). Moreover, since the subscription_id field is integer, it could be pretty easy for an attacker to guess the right value.Is there any other way of dealing with this that you could suggest?Thanks in advance.

I’m writing an app that uses the Strava API to show runs and whether they ran a segment or not. I don’t want to show data/details about the runs/athletes if the logged in user is not a “friend”.I cannot find anything in the documentation that shows an endpoint that would return a list of athletes that the logged in athlete follows, but I know I can GET an athlete and it will tell me if they are a friend or not, but I don’t want to spam that endpoint for every athlete/logged in athlete.If I ask AI it will talk about a `/athlete/friends` endpoint, but if I hit that I get a 401. I don’t know what scope I need for that (I have “read-all”).Can anyone help?

Hi,I´m using `${STRAVA_API_URL}/clubs/${clubId}/group_events` where const STRAVA_API_URL = "https://www.strava.com/api/v3"; For a certain clubId, which is 271922, I´m always getting a Gateway Time-Out. Now, I would understand they are having lots of events and hence this endpoint might need or have pagination available, but I cannot find any documentation about this.Is there any pagination documentation for this endpoint available?

I have developped an application that sends heart rate from a Wear OS watch to Garmin Edge bike computers. Heart rate is saved in a developer field that should override heart rate native values. I do the same for power (in a developer field inside the fit file). Power is displayed on Strava but not heart rate. It would be great if Strava displays heart rate values from developer fields with nativenum = 3 when heart rate is not already present in the .fit file.This way people will be able to use their Wear OS smartwatch as a HRM together with their Garmin GPS and get heart rate on Strava.Thanks for your consideration

Hi,We are pushing activities on Strava and we’d like to add line break and markdown into the description. We are using php code. With this example:$description = “I’ve done a test with **xxx**:\n";$description .= '**SV1**=150 W';The line break won’t appear in the activity description (nor the bold characters).  Does anyone has a solution for that ? Thanks,Pierre  

Hi everyone, I have a question that I can’t seem to find the answer/solution to. Basically upon plotting a route on Heatmaps the other day, I noticed that some local bike shops/mechanics are featured on the map but mine is not. Does anyone know how I can add my business to the map? I have tried adding it to Open Street Map (both shops I mentioned are also not on OSM) to no avail and I also have a Strava group too for my business.Any help would be appreciated, thanks

Hi,I would like the athletes capacity increase. currently it is just 1. Would like to to increase to 100. I’d be incredibly grateful for any help or direction to expedite this. 

please increase the limit stravaStravaMistake 403: Too many athletesThe limit of connected athletes has been exceeded. If you are the developer of this application, please contact Strava Developer Support to request an increase in the quota.application id 163714

Hello Strava Community, I have developed a non-commercial application named “FitScore” aimed at helping my office fitness group track and compare our activities. The app utilizes Strava data to generate weekly leaderboards, assign badges, and provide insights into our performance. To enhance the functionality of the app, I am requesting access to the following scopes:  activity:read_all profile:read_all  These scopes will allow the app to access detailed activity data and profile information necessary for generating accurate and personalized insights. The application is intended solely for personal use within our closed fitness group (20-25 members) and will not be distributed publicly or used for commercial purposes. I appreciate your consideration and am happy to provide any additional information required. Thank you!

Hello, I recently built a web app that utilizes data coming from Strada’s API. In that data there was a field named suffer_score, which seems to have disappeared within the last month. I’ve researched as to why, but could not find any documentation that this field was removed or renamed (I was thinking it may have been renamed to relative_effort).As a result of this field being removed unexpectedly, part of my app no longer works. Has anyone run into this issue before, or are there any solutions available? Thank you.

Hi Team, I am new to the Strava API and struggle to get the relative_effort and private_notes for my activities via the API. Anyone who solved this yet? activity:read_all is set.Many thanks Fabian

Given a user that has more than one gear for a specific sport, when an activity is registered through an external app (i.e. Garmin Conect), it will be imported with the default one, which makes the user update the gear field with the correct one.For example, let's say a cyclist has a mountain bike registered and a road bike. The mountain bike is set as default for cycling. The athlete registers a new activity with the road bike in Garmin Connect, which gets automatically imported into Strava as if it were roden with the mountain bike. After that, then the user logs into Strava and edits the activity to set the road bike instead of MTB as ridden.For a 3rd party application that is listening to the API webhooks, the final picture is that the activity was done with the mountain bike instead of the road bike, which is incorrect. This forces the application to make an additional call for each newly registered activity.Having a Webhook for this kind of activity update is something both Strav

Hi, I am developping a device that tracks your surfing, and my goal is for the device to create a FIT file that can be uploaded to Strava and display information about the surfing session. For a start, this information would be whether I am paddling or not, and the number and time of the waves taken.Diving into the FIT file format it looks like it might not be super easy to store boolean data (like paddling/not paddling). Do you have any recommendations about how to best display these kind of things on the app?Also, not all information present in the FIT file seems to be displayed on the Strava website/mobile app. For instance, I thought about using FIT Event messages (event_mesg.event = FIT_EVENT_SPORT_POINT and event_mesg.event_type = FIT_EVENT_TYPE_MARKER) to mark the point where I catch waves, but they are not displayed on the app. Is there a list of all the information from FIT files that can be displayed on Strava ?Thanks in advance for your help.

Hi all,I'm building a React Native app using Expo (in a development build on Android), and I'm integrating Strava OAuth. I'm using a custom URI scheme for redirection, generated like this:const redirectUri = AuthSession.makeRedirectUri({ scheme: 'runquest', path: 'strava-redirect', }); This results in a URI like:runquest://strava-redirect I'm primarily using the mobile authorization endpoint:https://www.strava.com/oauth/mobile/authorize But I’ve also tried the standard web endpoint:https://www.strava.com/oauth/authorize In both cases, when the user clicks "Authorize", I receive an "invalid redirect_uri" error from Strava.What I’ve tried: Setting "runquest" as the Authorized Callback Domain in the Strava Developer Dashboard Setting "localhost" as the Authorized Callback Domain in the Strava Developer Dashboard Trying variations like runquest://, runquest://strava-redirect, and runquest Testing with both OAuth endpoints My questions: What should I enter in the Authorized Callback D