Fitbit Web API migration guide
To migrate Fitbit Web API reads through HC Sync, add an Android app that reads Health Connect with user permission and uploads records to your backend API. The guide maps endpoints for steps, sleep and heart rate. HC Sync reads uploaded data through REST, signed webhooks or MCP; Free covers 5 synced users.
Last updated: 2026-11-04. Source for the 2026 service details: HC Sync pricing.
What changed for Fitbit Web API integrations?
- Support for the Fitbit Web API ended on 30 Sep 2026 and Google is turning it off. OAuth tokens and webhook subscriptions stop with it.
- The Google Fit REST API stopped taking new sign-ups in May 2024 and ends in 2026.
- Google's cloud successor is the Google Health API: new endpoints, Google OAuth, users must reconnect, and its scopes are restricted, so production access needs Google's privacy and security review. If you can get through that, it's a good route for Fitbit and Pixel data.
- The other route is Health Connect, Android's on-device health store, which Fitbit and most Android health apps write to. It has no cloud API, so an app on the phone reads it and sends the data up. No Google review of your backend, and it covers every app the user connects, not only Fitbit.
How does the new data flow work?
Your Android app asks the user for Health Connect permission. HC Sync reads new records about every hour in the background and posts them to its API. Your server reads them by REST, gets a signed webhook, or asks through MCP.
// settings.gradle.kts → dependencyResolutionManagement { repositories { maven("https://hcsync.dev/maven") } }
// app/build.gradle.kts → implementation("dev.hcsync:hcsync:0.3.0")
// userToken comes from your server: POST /v1/user-tokens with your secret key
HcSync.configure(context, userToken, types = setOf("steps", "sleep", "heart_rate"))
val ask = registerForActivityResult(HcSync.permissionContract()) { granted ->
if (granted.containsAll(HcSync.permissions(context))) HcSync.start(context)
}
ask.launch(HcSync.permissions(context))
How do the REST endpoints map?
| Fitbit Web API | HC Sync |
|---|---|
GET /1/user/-/activities/date/{date}.json (steps) | GET /v1/summary?user_id=… returns steps per day |
GET /1.2/user/-/sleep/date/{date}.json | GET /v1/records?user_id=…&type=sleep with stages; daily sleep_min in the summary |
GET /1/user/-/activities/heart/date/{date}/1d.json | GET /v1/records?type=heart_rate; daily avg_bpm in the summary |
| Intraday heart rate | heart_rate records carry the raw samples |
| Subscriptions API (webhooks) | PUT /v1/webhook, signed with HMAC-SHA256 |
| OAuth per user | A user token your server mints. No OAuth screen, just the Health Connect permission prompt |
How do you read data on your server?
curl https://hcsync.dev/v1/summary?user_id=u_123&days=7 \
-H "authorization: Bearer $HCSYNC_SECRET"
{"days":[{"day":"2026-10-28","steps":8412,"sleep_min":431,"avg_bpm":71}]}
How much does this integration cost?
Free for 5 users. $29 a month for 100 users, $149 for 1,000, $299 for 20,000. Hosted health-data APIs start at $300 a month (Junction) to $499 (Terra). Short on Android time? We can wire it into your app for you.
What does your app still need to do?
- Declare the Health Connect data types in Play Console, with a privacy policy that matches.
- Ask only for the types you use. HC Sync syncs only the types you pass to
configure. - iPhone users: Apple Health is a separate store and isn't covered yet.
What else should you know?
Does HC Sync work on iPhone?
Not yet. Health Connect is Android. Apple HealthKit is next if you ask for it.
How do I delete a user’s data?
DELETE /v1/users/{id} removes everything for that user immediately.
Where is data stored?
Records are stored in the US and deleted after 13 months.