Garmin Connect Developer Program: From Application to First Webhook in One Afternoon

For most of 2026 you could not get into the Garmin Connect Developer Program at all. Garmin paused new applications in March after a flood of inbound requests, and before that every applicant was vetted like an enterprise, with a business case review that took weeks or months. Our earlier attempt never got past the queue.

On October 21 Garmin reopened the program with three tiers: Personal (your own data), Starter (free, up to 1,000 connected users) and Enterprise (paid, historical backfill, support). On October 29 we applied for Starter with Vimo Swim. Here is what happened, hour by hour, and what we had to build on our side.

The timeline

• 13:36 Application submitted from developerportal.garmin.com. The form wants a registered company name, a website, a privacy policy URL, an OAuth redirect URL, a short description of what you do with the data, and which APIs you need. We asked for the Activity API only.
• 14:40 "Your application has been approved." One hour.
• 15:36 "Your Garmin Connect Developer app is ready." Client ID and secret issued, status Approved, key never expires.
• Evening Push endpoints registered, consent flow tested end to end.

What you have to build

Three pieces, and all three were ready before the approval came in, because the mock Garmin we wrote earlier let us finish the backend and the website against a fake consent page.

1. OAuth2 with PKCE. The user clicks Connect Garmin on your site, you send them to https://connect.garmin.com/oauth2Confirm with a code challenge, Garmin sends them back to your redirect URL with a code, and you exchange it at https://diauth.garmin.com/di-oauth2-service/oauth/token. The access token lives a day, the refresh token three months, and every refresh returns a new refresh token. Store both, refresh before use.

2. A push endpoint per data type. Garmin posts JSON to URLs you register: activity summaries, activity details, activity files (the FIT itself, delivered as a download URL you fetch with the user's bearer token) and deregistrations. Garmin signs nothing. The only authentication you get is whatever you put in the URL, so ours carries a long random token in the path and answers 404 to anything else. Always answer 200 once the body is stored; anything else and Garmin retries the same push.

3. The registration itself. This is the step nobody tells you about. Approval gives you credentials, not data. You still have to log in to API Tools at apis.garmin.com/tools/endpoints with the client ID and secret, paste a URL into each endpoint you handle, set delivery to Push and tick Enabled. Until you do that, Garmin has nowhere to send anything and your webhook sits there in silence.

ACTIVITY - Activities        https://<api>/garmin/webhook/<token>/activities/
ACTIVITY - Activity Details  https://<api>/garmin/webhook/<token>/activity-details/
ACTIVITY - Activity Files    https://<api>/garmin/webhook/<token>/activity-files/
COMMON   - Deregistrations   https://<api>/garmin/webhook/<token>/deregistrations/

The "Unverified app" banner

The first time you go through your own consent screen, Garmin shows "Unverified app. This connected app has not been verified by Garmin." It looks alarming. It is normal. Every new app shows it until you run Partner Verification, a self-service test suite in the same API Tools that fires requests at your registered endpoints and grades the responses. The connection works either way, the banner is cosmetic. Run the tests once your first real push has landed, so you know the endpoints behave before Garmin's robot checks them.

What it took

From the first form to a working consent flow: one afternoon, and most of that was waiting for email. The backend and website had been built weeks earlier against the mock, so the day itself was configuration: credentials into the prod env, endpoints into the portal, one test swim.

If you build for Garmin users and you were turned away or stuck in the queue earlier this year, apply again. The Starter tier is what the program should have been all along.