Developers & API

Is this issue happening to everyone?  Every request is returning a placeholder image.https://d3nn82uaxijpm6.cloudfront.net/assets/media/placeholder-photo@4x-6c5d2aaeadca1292be72943c04ea6defe7dcd610da7dc87a1ccaad30e134b2d6.png

According to the current Webhooks Events API documentation, only the client authenticates to Strava upon subscription registration/check, with the API client_id and client_secret.This is great but IMO insufficent, as both parties should somehow be authenticated. In other words, Strava should authenticate with the Webhook suscriptor. The way is done at the moment, an attacker could impersonate Strava's API sending fake event data to the client's endpoint. The only way the client could defend from this would be checking whether if the subscription ID matches or not. But this is neither proposed as a security measure in the documentation site, or implicit within the process (it's something that the clients would need to implement ad-hoc). Moreover, since the subscriptio

I’m writing an app that uses the Strava API to show runs and whether they ran a segment or not. I don’t want to show data/details about the runs/athletes if the logged in user is not a “friend”.I cannot find anything in the documentation that shows an endpoint that would return a list of athletes that the logged in athlete follows, but I know I can GET an athlete and it will tell me if they are a friend or not, but I don’t want to spam that endpoint for every athlete/logged in athlete.If I ask AI it will talk about a `/athlete/friends` endpoint, but if I hit that I get a 401. I don’t know what scope I need for that (I have “read-all”).Can anyone help?

Hi,I´m using `${STRAVA_API_URL}/clubs/${clubId}/group_events` where const STRAVA_API_URL = "https://www.strava.com/api/v3"; For a certain clubId, which is 271922, I´m always getting a Gateway Time-Out. Now, I would understand they are having lots of events and hence this endpoint might need or have pagination available, but I cannot find any documentation about this.Is there any pagination documentation for this endpoint available?

I have developped an application that sends heart rate from a Wear OS watch to Garmin Edge bike computers. Heart rate is saved in a developer field that should override heart rate native values. I do the same for power (in a developer field inside the fit file). Power is displayed on Strava but not heart rate. It would be great if Strava displays heart rate values from developer fields with nativenum = 3 when heart rate is not already present in the .fit file.This way people will be able to use their Wear OS smartwatch as a HRM together with their Garmin GPS and get heart rate on Strava.Thanks for your consideration

Hi,We are pushing activities on Strava and we’d like to add line break and markdown into the description. We are using php code. With this example:$description = “I’ve done a test with **xxx**:\n";$description .= '**SV1**=150 W';The line break won’t appear in the activity description (nor the bold characters).  Does anyone has a solution for that ? Thanks,Pierre  

Hi everyone, I have a question that I can’t seem to find the answer/solution to. Basically upon plotting a route on Heatmaps the other day, I noticed that some local bike shops/mechanics are featured on the map but mine is not. Does anyone know how I can add my business to the map? I have tried adding it to Open Street Map (both shops I mentioned are also not on OSM) to no avail and I also have a Strava group too for my business.Any help would be appreciated, thanks

Hi,I would like the athletes capacity increase. currently it is just 1. Would like to to increase to 100. I’d be incredibly grateful for any help or direction to expedite this. 

please increase the limit stravaStravaMistake 403: Too many athletesThe limit of connected athletes has been exceeded. If you are the developer of this application, please contact Strava Developer Support to request an increase in the quota.application id 163714

Hello Strava Community, I have developed a non-commercial application named “FitScore” aimed at helping my office fitness group track and compare our activities. The app utilizes Strava data to generate weekly leaderboards, assign badges, and provide insights into our performance. To enhance the functionality of the app, I am requesting access to the following scopes:  activity:read_all profile:read_all  These scopes will allow the app to access detailed activity data and profile information necessary for generating accurate and personalized insights. The application is intended solely for personal use within our closed fitness group (20-25 members) and will not be distributed publicly or used for commercial purposes. I appreciate your consideration and am happy to provide any additional information required. Thank you!

Hello, I recently built a web app that utilizes data coming from Strada’s API. In that data there was a field named suffer_score, which seems to have disappeared within the last month. I’ve researched as to why, but could not find any documentation that this field was removed or renamed (I was thinking it may have been renamed to relative_effort).As a result of this field being removed unexpectedly, part of my app no longer works. Has anyone run into this issue before, or are there any solutions available? Thank you.

Hi Team, I am new to the Strava API and struggle to get the relative_effort and private_notes for my activities via the API. Anyone who solved this yet? activity:read_all is set.Many thanks Fabian

Given a user that has more than one gear for a specific sport, when an activity is registered through an external app (i.e. Garmin Conect), it will be imported with the default one, which makes the user update the gear field with the correct one.For example, let's say a cyclist has a mountain bike registered and a road bike. The mountain bike is set as default for cycling. The athlete registers a new activity with the road bike in Garmin Connect, which gets automatically imported into Strava as if it were roden with the mountain bike. After that, then the user logs into Strava and edits the activity to set the road bike instead of MTB as ridden.For a 3rd party application that is listening to the API webhooks, the final picture is that the activity was done with the mountain bike instead of the road bike, which is incorrect. This forces the application to make an additional call for each newly registered activity.Having a Webhook for this kind of activity update

Hi, I am developping a device that tracks your surfing, and my goal is for the device to create a FIT file that can be uploaded to Strava and display information about the surfing session. For a start, this information would be whether I am paddling or not, and the number and time of the waves taken.Diving into the FIT file format it looks like it might not be super easy to store boolean data (like paddling/not paddling). Do you have any recommendations about how to best display these kind of things on the app?Also, not all information present in the FIT file seems to be displayed on the Strava website/mobile app. For instance, I thought about using FIT Event messages (event_mesg.event = FIT_EVENT_SPORT_POINT and event_mesg.event_type = FIT_EVENT_TYPE_MARKER) to mark the point where I catch waves, but they are not displayed on the app. Is there a list of all the information from FIT files that can be displayed on Strava ?Thanks in advance for your help.

Hi all,I'm building a React Native app using Expo (in a development build on Android), and I'm integrating Strava OAuth. I'm using a custom URI scheme for redirection, generated like this:const redirectUri = AuthSession.makeRedirectUri({ scheme: 'runquest', path: 'strava-redirect', }); This results in a URI like:runquest://strava-redirect I'm primarily using the mobile authorization endpoint:https://www.strava.com/oauth/mobile/authorize But I’ve also tried the standard web endpoint:https://www.strava.com/oauth/authorize In both cases, when the user clicks "Authorize", I receive an "invalid redirect_uri" error from Strava.What I’ve tried: Setting "runquest" as the Authorized Callback Domain in the Strava Developer Dashboard Setting

Hi Strava API Team,I’m currently integrating Strava into my application using the OAuth flow, and I’m successfully retrieving data for users who authenticate via Strava Login.Now I would like to use webhooks to get real-time updates (especially activities) from multiple users who have authenticated via my app. However, I have some questions regarding how this works: Is it possible to register a single webhook callback URL and receive activity updates for all authenticated users? Or do I need to register a separate webhook subscription for each user? If only one webhook subscription is allowed per app (as mentioned in the docs), how can I identify which user triggered the webhook event? Do I need to store each user's athlete_id upon login to match webhook payloads with users in my database

I'm currently working with the Strava API and using the GET /athlete endpoint to retrieve authenticated athlete data. However, I noticed that the response does not include the athlete's date of birth, even when requesting all available scopes (such as profile:read_all).My question is: Is there currently any way to retrieve the athlete's date of birth through the Strava API? If not, are there any known workarounds or plans to include this field in future updates? This data would be extremely useful for age-based features such as performance grouping, personalized training plans, or leaderboard segmentation.I've also sent a feature request to the Strava API team, but I wanted to check here in case anyone has encountered and solved this issue, or if there are any unofficial methods or fields I might have missed.Thanks in advance for your help!

I need data from Strava which I will use for my academical research and willing to sign Non Disclosure Agreement. How do I go about that?

https://developers.strava.com/docs/reference/#api-models-SummarySegmentstarred, hazardous, elevation_profile and elevation_profiles are missing in the documentationathlete_pr_effort, athlete_segment_stats are only specified in the documentation. Which is a shame. Without fetching each and every segment details for an activities segment (which of course would be madness), I cannot figure out a way to show the user which segments they have completed before and which they are completing for the first time.See fields of an entry in segment_efforts in a detailed activity:{ "id": 4803742, "resource_state": 2, "name": "Montvernier-Col du Chaussy", "activity_type": "Ride", "distance": 13785.6,

Receiving upload failed today for a workout data upload to strava app I'm developing, but the maximum requests I have made were 15 in 15 minutes, and 63 in a 24 hour period. But yet every time I try to upload an entry I’m getting the 429 status and upload fails. Why is this?

Now that Strava’s new Developer Program has introduced a limit on the number of athletes who can register with an app, we can see the number of "athletes currently connected" in our API settings.I can see that the number in the API settings (Strava side) is higher than the number of athletes using my app. I seem to remember (maybe incorrectly) that there was a time when apps did not have access to the deauthorization endpoint, so I (and maybe others) would simply delete the athlete account on the app side and ignore the incoming webhooks for those athletes.The net result is that some devs will now want to deauthorize 'stale' athletes, but they no longer have the access tokens required by the endpoint.Now that a limit is being put on the number of connected athletes per app, will there be an opportunity for devs to deauthorize athletes without access token? Otherwise some apps will be hitting their athlete li

I’m looking to update the PowerShell module started here: https://github.com/adamdriscoll/stravapwsh.  However, the challenge I’m having are the requirements put on me with regard to creating a new application.  I’m just interested in getting a Token to utilize the module and update it, not create an application.For example, I’d like to be able to perform all the various available API calls, but from the terminal.  Any help in acquiring a Token without creating an app is appreciated.

I've noticed that links with certain domain names, such as.xyz or.com, are supported (meaning they're recognized and clickable), but.app domains are not. Is there a list of domains that are supported? Unfortunately, my Strava app currently uses a.app domain. Is there a plan to provide more support?  

How to report security issues? I tried contacting security@strava.com but got no reply...  

Hello Strava Developer Support,I'm experiencing an issue with my Strava API application's OAuth authentication flow. My application details:Application Name: SPK Pace Maker Client ID: 160282 Authorization Callback Domain: 3e3a9aaf-439b-439f-a4f2-7a7eb41f362d-00-178qxgw1h4xux.worf.replit.devIssue Description:When users try to authenticate with my application, the OAuth flow gets stuck at the email input stage and loops back to asking for email repeatedly, never progressing to the password input or authorization screen.What I've tried:Verified Client ID and Client Secret are correct Confirmed Authorization Callback Domain matches exactly Tested with different scope combinations (read, activity:read) Used approval_prompt=auto as documented Followed the exact OAuth URL format from your document