CorrConnectDocs
Early accessRequest access

CorrConnect developer docs

CorrConnect lets an athlete share their workouts with your app. They approve the access, you read normalized activity summaries with a scoped token, and a webhook tells you when something new arrives. Early access: subject to change.

Start here

  1. Quickstart: register an app, get an athlete's approval and make your first call. About five minutes with your own account as the athlete.
  2. Connect a user: the full authorization flow for a production app, with state checks and token storage.
  3. Receive webhooks: stop polling. Verify the signature, answer within 10 seconds, fetch the record.

What you can build with it today

An athlete signs in to CorrConnect, picks what your app may see, and approves. Your app then holds a token that reads only what they approved:

ScopeEndpointsWhat your app can read
activities:readGET /v1/activities
GET /v1/activities/{activity_id}		The athlete's activity summaries, newest first.
profile:readGET /v1/profilesub, an ID for this athlete that only your app sees. No email or name.

Activities are summaries: sport, start time, duration, distance where the source recorded it, plus laps or segments for files. They never include GPS points, heart-rate streams or the original file. See the data model for every field.

How the pieces fit

Authorization code flow with PKCE1. Athlete's browser to Your app: Clicks Connect. 2. Your app to Athlete's browser: Redirect to /oauth/authorize with code_challenge and state. 3. Athlete's browser to CorrConnect: Signs in and approves the scopes. 4. CorrConnect to Your app: Redirect to your callback with code and state. 5. Your app to CorrConnect: POST /oauth/token with code and code_verifier. 6. CorrConnect to Your app: Access token and refresh token. 7. Your app to CorrConnect: GET /v1/activities with the Bearer token. 8. CorrConnect to Your app: Later: signed activity.created webhook.Athlete's browserYour appCorrConnectClicks Connect1Redirect to /oauth/authorize with code_challenge and state2Signs in and approves the scopes3Redirect to your callback with code and state4POST /oauth/token with code and code_verifier5Access token and refresh token6GET /v1/activities with the Bearer token7Later: signed activity.created webhook8
  1. You register an app once and get a client_id. There is no client secret; every app is a public client that proves itself with PKCE.
  2. You send the athlete to /oauth/authorize. They sign in to CorrConnect, read what you asked for and approve or deny.
  3. Your callback receives a one-use code. You swap it at /oauth/token for an access token (one hour) and a refresh token (rotates on every use).
  4. You call GET /v1/activities and GET /v1/profile with the access token.
  5. CorrConnect posts activity.created to your webhook when the athlete adds a workout, and grant.revoked when your access ends.

Free, with limits you can plan for

Each app gets 100 requests per 15 minutes and 10,000 per day, webhooks included at no cost. Every response tells you how much is left. The rate limits page has the exact rules and headers.

Reference

  • API reference: every endpoint, field and error, generated from the service's own OpenAPI document.
  • Webhook events: payloads, headers, signing and the retry schedule.
  • Errors: every error code, where it comes from and what to do.
  • OpenAPI document: load it into your HTTP client or code generator.

Get help

Email [email protected] with your app's client_id and the request_id from the response. Support lists what else helps us answer quickly.