Garmin Connect

Navigate to developer.garmin.com and find the Health API partner program application. Submit your application with your company details, use case description, and expected user volume. Garmin reviews applications manually — the approval timeline is typically 1–4 weeks, and some applications may require additional information or a brief call with Garmin's partner team. Do not wait for approval before starting your Bubble build. During the waiting period, set up Bubble's data model so you are ready to connect the moment you have credentials. Create a GarminActivity Data Type with fields: user (User), activity_id (text), activity_type (text), start_time (date), distance_meters (number), duration_seconds (number), avg_heart_rate (number), max_heart_rate (number), calories (number), raw_payload (text — store the full JSON for future field additions). Create a GarminDaily Data Type for daily summaries: user (User), summary_date (date), steps (number), stress_score (number), body_battery_high (number), sleep_score (number). Add Privacy rules to both: visible only to the associated user. Build a UI with mock data using Bubble's static data or a few manually-entered test records so you can refine the UX while waiting for credentials.

OAuth 1.0a HMAC-SHA1 signing requires computing a cryptographic signature from multiple parameters including a timestamp, nonce, and sorted parameter string — a process that Bubble's API Connector cannot perform natively. A Cloudflare Worker handles this in JavaScript, runs at the network edge (low latency), and is free for up to 100,000 requests per day on Cloudflare's free tier. Create a Cloudflare account at cloudflare.com if you do not have one. Navigate to Workers & Pages → Create a Worker. In the Worker editor, write a JavaScript Worker that: (1) receives an incoming request from Bubble's API Connector with the target Garmin endpoint path, per-user access_token, and token_secret as parameters, (2) builds the OAuth 1.0a Authorization header by computing the HMAC-SHA1 signature using the consumer_key, consumer_secret, access_token, and token_secret, (3) forwards the request to the Garmin Health API base URL (https://healthapi.garmin.com/wellness-api/rest) with the computed Authorization header, (4) returns Garmin's response to Bubble. Store consumer_key and consumer_secret in the Worker's environment variables (Settings → Variables → Environment Variables), never in the Worker code itself. Deploy the Worker and note its URL (https://YOUR-WORKER-NAME.YOUR-SUBDOMAIN.workers.dev). Bubble's API Connector will call this URL, not Garmin directly. RapidDev's team has implemented OAuth 1.0a Workers for Garmin integrations — a free scoping call at rapidevelopers.com/contact can save several hours of signing proxy implementation.

1// Cloudflare Worker: OAuth 1.0a signing proxy for Garmin Health API
2// Deploy at workers.cloudflare.com
3// Set environment variables: CONSUMER_KEY, CONSUMER_SECRET
4
5export default {
6  async fetch(request, env) {
7    const url = new URL(request.url);
8    const garminPath = url.searchParams.get('path'); // e.g., /dailies
9    const accessToken = url.searchParams.get('access_token');
10    const tokenSecret = url.searchParams.get('token_secret');
11
12    const garminBase = 'https://healthapi.garmin.com/wellness-api/rest';
13    const garminUrl = garminBase + garminPath + '?' + url.searchParams.toString()
14      .replace(/path=[^&]*&?/, '')
15      .replace(/access_token=[^&]*&?/, '')
16      .replace(/token_secret=[^&]*&?/, '');
17
18    const timestamp = Math.floor(Date.now() / 1000).toString();
19    const nonce = crypto.randomUUID().replace(/-/g, '');
20
21    // Build OAuth signature (simplified — use a full OAuth 1.0a library in production)
22    const authHeader = `OAuth oauth_consumer_key="${env.CONSUMER_KEY}",` +
23      `oauth_token="${accessToken}",` +
24      `oauth_signature_method="HMAC-SHA1",` +
25      `oauth_timestamp="${timestamp}",` +
26      `oauth_nonce="${nonce}",` +
27      `oauth_version="1.0",` +
28      `oauth_signature="<computed_signature>"`;
29
30    const garminResponse = await fetch(garminUrl, {
31      headers: { 'Authorization': authHeader }
32    });
33
34    return new Response(await garminResponse.text(), {
35      status: garminResponse.status,
36      headers: { 'Content-Type': 'application/json' }
37    });
38  }
39};

With the signing proxy deployed, configure Bubble's API Connector to call the Worker URL instead of Garmin directly. In Bubble's editor, click Plugins in the left sidebar, then 'Add plugins', search for 'API Connector' and install it (by Bubble, free). Click 'Add another API' and name it 'Garmin'. Set the base URL to your Cloudflare Worker URL (https://YOUR-WORKER-NAME.workers.dev). Add a shared header: key = 'X-Proxy-Auth', value = a secret token you define that the Worker validates (to prevent unauthorized use of your proxy). Check the 'Private' checkbox on this header — it stays server-side on Bubble's infrastructure and never reaches the browser. For per-user Garmin tokens, you cannot put them in a shared header because they vary by user. Instead, pass them as URL parameters in each API call: add parameters `access_token` (dynamic, from the current user's stored token) and `token_secret` (dynamic). The Worker reads these parameters and uses them when computing the OAuth signature. Mark these parameters as Private in Bubble to keep them server-side. Add your first API call: name it 'Get Daily Summary', method GET, URL suffix `/` with a `path` parameter set to `/dailies` and a `uploadStartTimeInSeconds` date parameter. Click 'Initialize call' — Bubble will send a real request to the proxy and record the response shape. Provide real test values (a valid access_token, token_secret, and a Unix timestamp date range). After successful initialization, the call appears as a usable data source in the editor.

1{
2  "api_name": "Garmin",
3  "base_url": "https://YOUR-WORKER.workers.dev",
4  "shared_headers": [
5    { "key": "X-Proxy-Auth", "value": "YOUR_PROXY_SECRET", "private": true }
6  ],
7  "calls": [
8    {
9      "name": "Get Daily Summary",
10      "method": "GET",
11      "path": "/",
12      "params": [
13        { "key": "path", "value": "/dailies", "private": false },
14        { "key": "access_token", "value": "<dynamic: Current User's garmin_access_token>", "private": true },
15        { "key": "token_secret", "value": "<dynamic: Current User's garmin_token_secret>", "private": true },
16        { "key": "uploadStartTimeInSeconds", "value": "<dynamic: start timestamp>", "private": false },
17        { "key": "uploadEndTimeInSeconds", "value": "<dynamic: end timestamp>", "private": false }
18      ]
19    }
20  ]
21}

Individual Garmin users must authorize your application to access their health data via OAuth 1.0a. The authorization dance has three steps: request token → authorization URL → callback/access token exchange. This entire flow must happen in your Cloudflare Worker or a separate backend, because OAuth 1.0a token requests also require HMAC-SHA1 signing. The flow: (1) Your Bubble app redirects the user to your Worker with a 'start_auth' flag. The Worker calls Garmin's request token endpoint (https://connectapi.garmin.com/oauth-service/oauth/request_token) with signed credentials, receives a temporary oauth_token, and redirects the user to Garmin's authorization page (https://connect.garmin.com/oauthConfirm?oauth_token=TEMP_TOKEN). (2) The user logs in on Garmin.com and approves access. (3) Garmin redirects back to your callback URL (your Worker or a Bubble Backend Workflow URL) with oauth_token and oauth_verifier parameters. Your Worker or workflow exchanges these for a permanent access_token and token_secret by calling Garmin's access token endpoint. Store the returned access_token and token_secret on the Bubble User record (add fields garmin_access_token and garmin_token_secret to the User data type — mark these Private in Bubble Privacy rules). These credentials are used in every subsequent API call through the signing proxy. This is the most complex part of the Garmin integration. For production apps, test the full OAuth flow end-to-end with a personal Garmin account before enabling it for users.

Garmin's data model is push-based: when a user syncs their device, Garmin POSTs a Ping notification to your registered endpoint. The Ping does not contain activity data — it contains a summary ID and notification type. You must make a separate signed GET call to the Garmin API to fetch the actual data using the summary ID from the Ping. First, enable the Workflow API in Bubble: go to Settings → API → check 'Enable Workflow API' (requires paid plan). In the Backend Workflows section (Workflow tab → Backend Workflows), create a new workflow named 'receive_garmin_ping'. Add a 'Detect request data' step to learn the incoming Ping payload shape. To initialize, register your workflow URL in the Garmin partner portal and trigger a test Ping from Garmin's partner testing tools — or send a manual POST to the /initialize URL with a sample Ping payload. A sample Garmin Ping payload looks like: { 'pingType': 'DAILY_SUMMARY', 'callbackURL': 'https://healthapi.garmin.com/wellness-api/rest/dailies/...' }. After Detect request data initializes, add the following steps: (1) Use the API Connector to call your signing proxy with the callbackURL path from the Ping (this fetches the full activity or daily summary data). (2) Parse the response and Create a new GarminActivity or GarminDaily record in Bubble. Register your Backend Workflow URL (https://YOUR-APP.bubbleapps.io/api/1.1/wf/receive_garmin_ping) in the Garmin partner portal as your Ping callback URL for each notification type you subscribe to.

1// Sample Garmin Ping payload (incoming POST to your Backend Workflow)
2{
3  "activityDetails": [{
4    "callbackURL": "https://healthapi.garmin.com/wellness-api/rest/activities/12345",
5    "userId": "garmin_user_abc123",
6    "userAccessToken": "user_oauth_token"
7  }]
8}
9
10// After receiving the Ping, fetch the full activity with a signed GET:
11// GET https://YOUR-WORKER.workers.dev/?path=/activities/12345&access_token=...&token_secret=...

With data flowing into Bubble via Garmin Pings, build the display UI. Create a dashboard page with a Repeating Group bound to 'Do a search for GarminActivities where user is Current User', sorted by start_time descending. Display columns for date, activity type, distance (convert meters to km or miles with a math expression), duration (format as HH:MM:SS), and average heart rate. For trend charts, install a chart plugin (ApexCharts by Zeroqode or similar from the Plugins marketplace). Bind a line chart to a search for GarminDaily records for the past 30 days, with steps on the Y axis and summary_date on the X axis. WU cost estimation is important for Garmin integrations at scale. Each Garmin Ping triggers a Backend Workflow that runs a Bubble API Connector call (via the proxy) plus a Create Data Thing action. For a fitness app with 500 active Garmin users each syncing once daily, that is 500 Backend Workflow executions per day. Consult Bubble's WU pricing page (Settings → Usage) to estimate monthly costs at your expected user volume. Bubble's Workflow logs (Logs tab) show WU consumption per workflow run — check these during testing to calibrate your estimate.