Authentication

Every API request uses an organisation-scoped API key.

Create a key

1. Open the organisation in Strave.
2. Open Settings.
3. Select Developer API.
4. Enter a descriptive name and optional expiration.
5. Choose Create key and copy the secret immediately.

Only members with API-key management permission can view or manage keys. The full secret is shown once, so copy it before closing the dialog.

Send the key

Use the standard Bearer authorization header:

Authorization: Bearer strave_api_key

Do not put a key in a query string, commit it to Git, or expose it in client-side JavaScript. Use environment variables or your deployment platform's secret store.

STRAVE_API_KEY=strave_api_key

What a key can access

Each key can:

• read API resources for the organisation that created it;
• connect to that organisation's realtime gateway.

The API is read-only. Keys cannot create or change events, teams, matches, users, or organisation settings. A resource outside the key's organisation returns 404.

Rotation and revocation

Rotate creates a replacement and revokes the previous key. The replacement secret is shown once.

For a zero-downtime change, create a second key, update your integration, verify that it works, and then revoke the old key. Revoke invalidates a key immediately.

Keys are limited to 600 authenticated operations per minute. A gateway connection consumes authentication capacity when it identifies, not for every dispatch it receives.