Stride

Search Documentation

Search for articles, guides, and more

Authentication

Every endpoint takes a bearer token. Which kind depends on whether you are building for yourself, for other athletes, or for your own server.

Personal access tokens

For your own scripts. Create one under Settings → API, pick its scopes, and send it as a bearer token. It acts as you, it is shown once, and revoking it in settings stops it working on the next request.

bash
curl "https://api.stride.is/v1/athletes/me/activities?start=2026-01-01" \
  -H "Authorization: Bearer stride_pat_..."

OAuth, for other athletes

Register an app to get a client_id. Server-side apps also get a client_secret; native and browser apps do not, because they cannot keep one, and use PKCE instead.

Send the athlete to the authorization endpoint:

text
https://api.stride.is/oauth/authorize
  ?client_id=oauthc_...
  &redirect_uri=https://yourapp.example/callback
  &response_type=code
  &resource=https://api.stride.is/v1
  &scope=athlete.read%20activities.read
  &code_challenge=<S256 challenge>
  &code_challenge_method=S256
  &state=<your state>

The resource parameter matters: it is what binds the token to this API. They approve the scopes you asked for, you receive a code on your redirect URI, and you exchange it:

bash
curl -X POST https://api.stride.is/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=authorization_code \
  -d code=$CODE \
  -d redirect_uri=https://yourapp.example/callback \
  -d code_verifier=$VERIFIER

Access tokens last an hour. The refresh token lasts 90 days and is revoked the moment the athlete disconnects your app, so treat a failed refresh as a disconnection rather than an error to retry.

A token reaches what the athlete reaches

If a coach connects your app, it can also read the athletes they coach, because they can. Use GET /teams and GET /teams/{team_id}/members to discover which IDs you may pass as athlete_id. Any other ID is refused.

Your app acting as itself

Managing your own webhooks needs no athlete, so it uses a different credential: the client credentials grant. The token it returns can manage your subscriptions and read your usage, and cannot read any athlete's data at all.

bash
curl -X POST https://api.stride.is/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=client_credentials

Discovery

The OAuth metadata is published at /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource/v1, and the OpenAPI document at https://api.stride.is/v1/openapi.json. All three are public.