Google Fit

All Google API access begins in the Google Cloud Console. Follow these steps carefully — skipping any one of them is the most common cause of failed OAuth setups. Create or select a Google Cloud project Go to console.cloud.google.com. Click the project selector at the top of the page and click New Project. Give it a name related to your Bubble app (e.g., my-bubble-health-app) and click Create. Wait for the project to be created and confirm it is selected as the active project. Enable the Fitness API In the left sidebar, go to APIs & Services → Library. Search for Fitness API. Click on it and click Enable. This is the API that gives your Google Cloud project permission to access users' Google Fit data. Do not skip this step — calls to the Fitness REST API will return 403 errors if the API is not enabled on the project. Configure the OAuth consent screen Go to APIs & Services → OAuth consent screen. Select External (for apps serving any Google user) and click Create. Fill in: - App name: the name of your Bubble app - User support email: your email address - Developer contact information: your email address Click Save and Continue. On the Scopes page, click Add or Remove Scopes and add: - https://www.googleapis.com/auth/fitness.activity.read - https://www.googleapis.com/auth/fitness.heart_rate.read (if you need heart rate) - https://www.googleapis.com/auth/fitness.sleep.read (if you need sleep data) Verify the exact scope names at developers.google.com/fit/datatypes — Google has updated scope naming over time. Click Save and Continue. Create OAuth 2.0 credentials Go to APIs & Services → Credentials → Create Credentials → OAuth 2.0 Client ID. Select Web application as the application type. Under Authorized redirect URIs, add your Bubble app's OAuth callback URL. This URL follows the pattern: https://your-app-name.bubbleapps.io/api/1.1/wf/google_oauth_callback (you will create this Backend Workflow in Step 2). If your app uses a custom domain, use that domain instead. Click Create. Note the Client ID and Client Secret — you will need both in the next steps.

1{
2  "Fitness API scopes": [
3    "https://www.googleapis.com/auth/fitness.activity.read",
4    "https://www.googleapis.com/auth/fitness.heart_rate.read",
5    "https://www.googleapis.com/auth/fitness.sleep.read"
6  ],
7  "OAuth redirect URI pattern": "https://<your-app>.bubbleapps.io/api/1.1/wf/google_oauth_callback"
8}

The OAuth 2.0 authorization code flow requires a server-side step: when Google redirects the user back to your app with an authorization code, you must exchange that code for access and refresh tokens server-side using your client_secret. In Bubble, this server-side step runs in a Backend Workflow. Enable the Workflow API In Bubble's editor, go to Settings → API. Check the box labeled This app exposes a Workflow API. This enables Backend Workflows and makes your app's Backend Workflow URLs publicly accessible. This feature requires a paid Bubble plan (Starter $32/month or higher). Create the OAuth callback Backend Workflow Click on the Backend Workflows section in the left panel. Click New API Workflow. Name it google_oauth_callback. Add one URL parameter: code (type Text). This is the authorization code Google sends back after the user approves access. Inside the workflow, add these steps: Step 1 — Exchange the authorization code: add a Plugins → API Connector action. Call the token exchange endpoint (you will add this call to the API Connector in the next step). Pass code = code (URL parameter). Step 2 — Store the tokens on the User: add a Make changes to a thing action. Thing to change: Do a search for Users where (condition to identify the correct user — see tip below). Set two fields: - google_access_token (Text) = result of Step 1's access_token field - google_refresh_token (Text) = result of Step 1's refresh_token field - google_token_issued_at (Date) = Current date/time Add token fields to the User Data Type Go to Data → User → click Edit fields. Add: - google_access_token (Text) - google_refresh_token (Text) - google_token_issued_at (Date) Add a Privacy rule to the User Data Type: ensure google_access_token and google_refresh_token are only visible to Current User = This User. Token data must never be readable by other users. Configure the token exchange API call In the API Connector, under the Google Fit group (created in Step 3), add a call named Exchange Token: - Method: POST - URL: https://oauth2.googleapis.com/token - Body type: Form data (application/x-www-form-urlencoded) - Body fields: - code: (dynamic — the code from the URL parameter) - client_id: your Google Cloud Client ID (can be Public) - client_secret: your Google Cloud Client Secret — mark Private - redirect_uri: your callback URL - grant_type: authorization_code (static) Initialize this call with a test auth code. The initialization will fail because codes expire quickly — that is acceptable. Bubble only needs to detect the response shape (access_token, refresh_token, expires_in). Use a dummy response from the Google token endpoint documentation to manually type the field structure if needed.

1{
2  "Token exchange POST": {
3    "url": "https://oauth2.googleapis.com/token",
4    "method": "POST",
5    "content_type": "application/x-www-form-urlencoded",
6    "body": {
7      "code": "<authorization_code>",
8      "client_id": "<your_client_id>",
9      "client_secret": "<your_client_secret_PRIVATE>",
10      "redirect_uri": "https://<your-app>.bubbleapps.io/api/1.1/wf/google_oauth_callback",
11      "grant_type": "authorization_code"
12    }
13  }
14}

With the token exchange workflow in place, configure the API Connector to make the actual Google Fit data calls. Create the Google Fit API group In the Plugins tab, click API Connector → Add another API. Set: - API Name: Google Fit - Authentication: None or self-handled - Shared headers: - Authorization: Bearer <access_token> — check the Private checkbox The access_token value in the shared header will be dynamically replaced when you make calls in workflows — you will pass Current User's google_access_token as the Bearer value. The Private checkbox ensures this token value is never exposed in client-side JS, even though it varies per user. Add the Initialize data sources call Click Add another call. Configure: - Call name: Get Data Sources - Method: GET - URL: https://www.googleapis.com/fitness/v1/users/me/dataSources - Use as: Data Click Initialize call with a real Google access token for a test user who has Google Fit data. Bubble will detect the response structure (a dataSources array). This is your initialization call — use it every time you need to verify credentials are working. Add the Connect Google Fit button on your app's settings page Create a button element labeled Connect Google Fit. In its workflow, add a Navigate to an external website action with this URL: https://accounts.google.com/o/oauth2/v2/auth?client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_CALLBACK_URL&response_type=code&scope=https://www.googleapis.com/auth/fitness.activity.read&access_type=offline&prompt=consent Replace YOUR_CLIENT_ID and YOUR_CALLBACK_URL with your actual values. The access_type=offline parameter is critical — it tells Google to issue a refresh token so the user does not need to re-authorize every hour. The prompt=consent forces Google to always show the consent screen (necessary to receive a new refresh token on subsequent authorizations).

1{
2  "Google Fit API group": {
3    "API Name": "Google Fit",
4    "Shared headers": [
5      {
6        "key": "Authorization",
7        "value": "Bearer <access_token>",
8        "private": true
9      }
10    ]
11  },
12  "Authorization URL": "https://accounts.google.com/o/oauth2/v2/auth?client_id=<CLIENT_ID>&redirect_uri=<CALLBACK_URL>&response_type=code&scope=https://www.googleapis.com/auth/fitness.activity.read&access_type=offline&prompt=consent"
13}

This step is the most technically distinctive part of the Google Fit integration. Unlike most REST APIs, Google Fit uses a POST request to fetch aggregated fitness data — not a GET. Developers who try to use GET receive 404 or 405 errors and assume the API is broken. It is not; the endpoint simply uses POST with a JSON body. Understand the aggregation endpoint The endpoint is: POST https://www.googleapis.com/fitness/v1/users/me/dataset:aggregate The request body specifies: - aggregateBy: the data type(s) to fetch (e.g., com.google.step_count.delta for steps) - bucketByTime: how to group results (e.g., 86400000 milliseconds = 1 day) - startTimeMillis: start of the date range (Unix milliseconds) - endTimeMillis: end of the date range (Unix milliseconds) Add the aggregation call to the API Connector In the Google Fit API group, click Add another call. Configure: - Call name: Aggregate Steps - Method: POST - URL: https://www.googleapis.com/fitness/v1/users/me/dataset:aggregate - Body type: JSON - Use as: Data Set the body to: { "aggregateBy": [{"dataTypeName": "com.google.step_count.delta"}], "bucketByTime": {"durationMillis": 86400000}, "startTimeMillis": <start_ms>, "endTimeMillis": <end_ms> } For the Initialize call, calculate a real Unix millisecond timestamp for today minus 7 days. For example, a startTimeMillis of 7 days ago and endTimeMillis of now (both as numbers without quotes). The Initialize call must succeed with a real response for Bubble to detect the nested response structure. Understand the response structure The aggregate response is nested: { "bucket": [ { "startTimeMillis": "...", "endTimeMillis": "...", "dataset": [ { "point": [ { "value": [{"intVal": 8432}] } ] } ] } ] } The actual step count is at bucket → dataset → point → value → intVal — four levels deep. Bubble can detect this nested path after initialization, but you may need to use a JavaScript transformer (via the Toolbox plugin → Run JavaScript action) to extract the value cleanly for display in page elements. Note on the deprecation context: the Google Fitness REST API was deprecated in 2024. The exact shutdown date has not been confirmed by Google. Build monitoring into your app: if the API starts returning 410 Gone or similar error codes, surface a clear message to your users and pause further calls. For new apps without an existing Google Fit user base, Fitbit is a more stable long-term choice.

1{
2  "Aggregate Steps call": {
3    "method": "POST",
4    "url": "https://www.googleapis.com/fitness/v1/users/me/dataset:aggregate",
5    "headers": {
6      "Authorization": "Bearer <access_token_PRIVATE>",
7      "Content-Type": "application/json"
8    },
9    "body": {
10      "aggregateBy": [{"dataTypeName": "com.google.step_count.delta"}],
11      "bucketByTime": {"durationMillis": 86400000},
12      "startTimeMillis": "<start_ms>",
13      "endTimeMillis": "<end_ms>"
14    }
15  }
16}

Build the Bubble pages that display Google Fit data and implement the token refresh mechanism to keep the integration running beyond the 1-hour access token expiry. Build the dashboard page Create a page called fitness-dashboard. Add: - A date range picker (two Date Inputs: start date and end date) - A Repeating Group with data source: Get data from an external API → Google Fit — Aggregate Steps. Pass the date range inputs as startTimeMillis and endTimeMillis (converted to Unix milliseconds) - Inside the Repeating Group: text elements showing the date and step count extracted from the nested response - A summary section above the Repeating Group showing total steps (sum all bucket values) and average daily steps For charts, install a chart plugin (e.g., ApexCharts by Zeroqode) and bind the step data to a bar chart element. Add the token refresh Backend Workflow Create a second Backend Workflow called refresh_google_token. Inside it: - Add an API Connector action calling a new Refresh Token call (POST https://oauth2.googleapis.com/token with grant_type=refresh_token, client_id, client_secret (Private), and refresh_token from the User record) - Update the User's google_access_token field with the new access_token from the response - Update the google_token_issued_at field to Current date/time Schedule the refresh On the fitness-dashboard page's page load workflow, add a conditional step: If Current User's google_token_issued_at is less than 55 minutes ago — do nothing. Otherwise — Schedule API Workflow: refresh_google_token for Current User. This ensures tokens are refreshed before they expire, not after a failed API call. RapidDev's team has configured OAuth 2.0 flows and token refresh systems in dozens of Bubble apps with third-party APIs. If you need help setting up the complete token lifecycle for Google Fit or other OAuth providers, book a free scoping call at rapidevelopers.com/contact.

1{
2  "Refresh Token call": {
3    "method": "POST",
4    "url": "https://oauth2.googleapis.com/token",
5    "content_type": "application/x-www-form-urlencoded",
6    "body": {
7      "client_id": "<your_client_id>",
8      "client_secret": "<your_client_secret_PRIVATE>",
9      "refresh_token": "<user_refresh_token>",
10      "grant_type": "refresh_token"
11    }
12  }
13}

Before testing with real users, lock down data access and verify the complete authorization and data flow end to end. Verify Privacy rules Go to Data → Privacy → User. Confirm that the google_access_token, google_refresh_token, and google_token_issued_at fields are only visible when Current User is This User. These fields contain sensitive credentials and must not be readable by other users through Bubble's data API. Test the full flow In Bubble's editor, click Preview to open the preview mode. Navigate to your settings page and click Connect Google Fit. Verify: 1. The browser redirects to Google's OAuth consent screen 2. After approving access, Google redirects back to your Bubble app's callback URL 3. The Backend Workflow fires, exchanges the code for tokens (check Logs tab → Workflow logs) 4. The User record now has google_access_token and google_refresh_token populated (check Data tab → User) 5. Navigate to the fitness-dashboard page — the Repeating Group populates with step data for the past 7 days 6. Check the Logs tab to verify no 401 or 403 errors, and review WU consumption per API call Test token refresh Change the google_token_issued_at field on the test User to a time 56 minutes in the past (manually in the Data tab). Reload the dashboard page and verify the refresh_google_token Backend Workflow fires and the token is updated in the User record. Test error handling Set the User's google_access_token to an invalid value and reload the dashboard. Verify that your app displays a clear error message rather than a blank Repeating Group. Add a conditional in the page's workflow: if the API call returns an error, navigate to the settings page with a message: Your Google Fit connection has expired — click Reconnect to restore access.