Skip to main content

Hello Strava Developer Support,

I'm experiencing an issue with my Strava API application's OAuth authentication flow. My application details:

  • Application Name: SPK Pace Maker
  • Client ID: 160282
  • Authorization Callback Domain: 3e3a9aaf-439b-439f-a4f2-7a7eb41f362d-00-178qxgw1h4xux.worf.replit.dev

Issue Description:
When users try to authenticate with my application, the OAuth flow gets stuck at the email input stage and loops back to asking for email repeatedly, never progressing to the password input or authorization screen.

What I've tried:

  • Verified Client ID and Client Secret are correct
  • Confirmed Authorization Callback Domain matches exactly
  • Tested with different scope combinations (read, activity:read)
  • Used approval_prompt=auto as documented
  • Followed the exact OAuth URL format from your documentation

Current OAuth URL being used:

 

https://www.strava.com/oauth/authorize?client_id=160282&redirect_uri=https%3A%2F%2F3e3a9aaf-439b-439f-a4f2-7a7eb41f362d-00-178qxgw1h4xux.worf.replit.dev%2Fapi%2Fauth%2Fstrava%2Fcallback&response_type=code&approval_prompt=auto&scope=activity:read,read

 

Could you please help me understand why the authentication flow is not progressing past the email input? Is there something wrong with my application configuration or does it need additional approval?

Thank you for your assistance.

In what browser do your users try to authenticate? This problem can arise when not using one of the officially Strava supported browsers.

Thank you for the quick response. I am using Chrome (officially supported browser) and the issue persists.

Additional details that might help:

  • The authentication gets stuck specifically at the email input stage - it accepts the email but loops back instead of proceeding to password
  • This happens consistently across multiple attempts
  • No browser extensions or ad blockers are interfering
  • Cookies and third-party cookies are enabled

Questions:

  1. Does my application (ID: 160282) require any special approval or review before OAuth works properly?
  2. Are there any known issues with applications hosted on Replit domains?
  3. Should I be using a different scope combination for basic authentication?
  4. Is there a way to check if my application is properly configured on your end?

The OAuth URL format I'm using matches your documentation exactly. Any guidance would be appreciated.

The login process in Strava is the same regardless whether you come from an app authorization or the usual direct login in www.strava.com. I would try deleting all the Strava cookies or another browser and then I would go directly to www.strava.com in order to login.

Terms & ConditionsCookie settings