Docs

API quickstart

Call the Strave v2 API with an installed Application.

The Strave API lets installed Applications read and manage tournament data and receive webhooks. This guide takes you from a new Application to your first API request.

Strave authorizes each request against the Application, its Installation, the token scopes, and the plan of the Application Owner.

Base URL

All API routes use this base URL:

https://strave.gg/api/v2

Step 1: Register and install an Application

To use the API, you need an Application and an Installation of it. In the developer portal or with the /developer/apps routes:

  1. Create an Application.
  2. Turn on the permissions that the Application needs.
  3. Get an Installation. The owner is always installed. Users install the Application when they authorize it, and organisation managers install it from its install link.

Changes to an Application apply at once. The /developer/* routes use your signed-in Strave identity, not an Application OAuth access token. For authentication details and request examples, see Developer controls.

Step 2: Obtain an access token

The credential depends on who acts through the Application:

  • For users, use Login with Strave: the OAuth 2.1 authorization code grant with S256 PKCE.
  • For servers, use a trusted workload, an API key, or a client secret.

Access tokens expire after 15 minutes. Request a new token when the current one expires. Don't store a token as a permanent secret. For details, see Authentication.

In the examples, the token is in the STRAVE_ACCESS_TOKEN environment variable. Keep it in the secret store of the calling service.

Step 3: Make a request

To test your token, request the current user:

curl https://strave.gg/api/v2/users/@me \
  --header "Authorization: Bearer $STRAVE_ACCESS_TOKEN"

Successful item responses use the shape { "data": { ... } }. Collection responses also include meta.nextCursor and meta.hasMore.

Step 4: Handle updates

To react to changes in Strave, create a webhook endpoint for the Application. Subscribe it to the event types that GET /event-types returns. Strave signs each delivery with HMAC SHA-256 and keeps a delivery history for retries and redelivery.

Next steps