Withings

Withings uses OAuth 2.0 with an authorization code flow. You need a client_id and client_secret before configuring anything in Bubble. Create a Withings developer account Go to developer.withings.com. Click Sign up (or use your existing Withings account credentials). Once logged in, navigate to Applications and click Create an application. Fill in: - Application name: a name describing your Bubble app - Application description: brief description of how you will use Withings data - Callback URL: the URL where Withings will redirect users after authorization. This will be your Bubble Backend Workflow URL — pattern: https://your-app.bubbleapps.io/api/1.1/wf/withings_oauth_callback. You will create this Backend Workflow in Step 2. For now, enter a placeholder or your expected URL. After creating the application, note your client_id and client_secret. Keep client_secret confidential — it will go in a Private header in the Bubble API Connector and never appear in client-side code. Understand the Withings API base pattern All Withings API calls go to https://wbsapi.withings.net. The service (category of endpoint) and action (specific operation) are specified as parameters. For example: - POST https://wbsapi.withings.net/measure with action=getmeas in the body fetches measurements - POST https://wbsapi.withings.net/notify with action=subscribe sets up push notifications - POST https://wbsapi.withings.net/v2/oauth2 with action=requesttoken exchanges an authorization code for tokens The base URL is always https://wbsapi.withings.net — what changes is the path segment and the action value. In Bubble's API Connector, you can either use a single base URL and add path segments per call, or configure each call's full URL separately. The latter is clearer for beginners.

1{
2  "Withings API base patterns": {
3    "all_methods": "POST",
4    "base_url": "https://wbsapi.withings.net",
5    "examples": [
6      { "endpoint": "/measure",    "action": "getmeas",       "purpose": "Fetch measurements (weight, BP, etc.)" },
7      { "endpoint": "/notify",     "action": "subscribe",     "purpose": "Subscribe to push notifications" },
8      { "endpoint": "/v2/oauth2",  "action": "requesttoken",  "purpose": "Exchange auth code for tokens" },
9      { "endpoint": "/v2/oauth2",  "action": "refreshtoken",  "purpose": "Refresh access token" }
10    ]
11  }
12}

The OAuth 2.0 token exchange must happen server-side — your client_secret cannot appear in client-side code. In Bubble, server-side processing that receives incoming HTTP requests requires Backend Workflows, which are only available on paid plans. Enable the Workflow API In Bubble's editor, go to Settings → API. Check the box labeled This app exposes a Workflow API. This makes your app's Backend Workflow URLs publicly accessible as HTTPS endpoints. This feature requires a paid Bubble plan (Starter $32/month or higher). Without enabling this, the OAuth callback URL cannot receive Withings' redirect. Add token fields to the User Data Type Go to Data → User → click Edit fields. Add: - withings_access_token (Text) - withings_refresh_token (Text) - withings_token_issued_at (Date) - withings_user_id (Text): the Withings user ID returned during token exchange Go to Data → Privacy → User. Add a rule: When Current User is This User — ensure the four fields above are checked as visible. Token data must not be readable by other users. Create the OAuth callback Backend Workflow Click Backend Workflows in the left panel. Click New API Workflow. Name it withings_oauth_callback. Add URL parameters: - code (Text): the authorization code Withings sends after user approval - state (Text): the Bubble user identifier passed through the OAuth flow to link the token to the right user (see tip below) Inside the workflow, add: Step 1: API Connector action → Exchange Withings Token (you will create this call in Step 3). Pass code from the URL parameter. Step 2: Make changes to a thing → find User where Unique ID = URL parameter state, set withings_access_token, withings_refresh_token, withings_token_issued_at, and withings_user_id from Step 1's response. This Backend Workflow URL is: https://your-app.bubbleapps.io/api/1.1/wf/withings_oauth_callback. Copy this URL and update your Withings developer application's Callback URL to match.

1{
2  "OAuth callback Backend Workflow": {
3    "name": "withings_oauth_callback",
4    "url_params": ["code", "state"],
5    "steps": [
6      "Call API Connector: Exchange Withings Token (POST /v2/oauth2 action=requesttoken)",
7      "Make changes to User where unique_id = state param: set tokens from Step 1 response"
8    ]
9  }
10}

Now configure the API Connector with all the Withings calls your app needs. Create the Withings API group In the Plugins tab, click API Connector → Add another API. Set: - API Name: Withings - Authentication: None or self-handled - Shared headers: - Authorization: Bearer <access_token> — check the Private checkbox Do not put client_secret or client_id in the shared headers — those are only needed for token exchange and refresh calls and should be added as private fields on those specific calls. Add the Token Exchange call Click Add another call. Configure: - Call name: Exchange Token - Method: POST (required for all Withings calls — never GET) - URL: https://wbsapi.withings.net/v2/oauth2 - Body type: JSON or Form data - Body fields: - action: requesttoken (static) - client_id: your Withings client_id (can be non-private) - client_secret: your Withings client_secret — mark as a Private body parameter - code: the authorization code (dynamic — from the callback URL parameter) - grant_type: authorization_code (static) - redirect_uri: your callback URL (static) - Use as: Action Click Initialize call. The Initialize call will fail because authorization codes expire immediately — this is expected. After the failure, Bubble may not detect the response shape. Manually define the expected fields in the API Connector response section: access_token (text), refresh_token (text), userid (text). Add the Get Measurements call Click Add another call. Configure: - Call name: Get Measurements - Method: POST (all Withings calls are POST) - URL: https://wbsapi.withings.net/measure - Body type: JSON - Body: - action: getmeas (static) - meastype: 1 (for weight — see meastype reference below) - category: 1 (real measurements, not objectives) - Use as: Data Click Initialize call with a real access token for a test Withings account that has measurement data. Bubble detects the response structure: a measuregrps array where each item has a date field and a measures array with value, type, and unit sub-fields. Withings meastype reference: - 1 = weight (kg × 10^unit) - 4 = height - 6 = fat mass % - 9 = diastolic blood pressure (mmHg) - 10 = systolic blood pressure (mmHg) - 11 = heart pulse (BPM) - 54 = SpO2 (%) Add the Refresh Token call Click Add another call. Configure: - Call name: Refresh Token - Method: POST - URL: https://wbsapi.withings.net/v2/oauth2 - Body: - action: refreshtoken - client_id: your client_id - client_secret: your client_secret — Private - refresh_token: the user's stored refresh_token (dynamic) - Use as: Action

1{
2  "Get Measurements call": {
3    "method": "POST",
4    "url": "https://wbsapi.withings.net/measure",
5    "headers": {
6      "Authorization": "Bearer <access_token_PRIVATE>",
7      "Content-Type": "application/json"
8    },
9    "body": {
10      "action": "getmeas",
11      "meastype": "<meastype_number>",
12      "category": "1"
13    }
14  },
15  "Refresh Token call": {
16    "method": "POST",
17    "url": "https://wbsapi.withings.net/v2/oauth2",
18    "headers": {
19      "Content-Type": "application/json"
20    },
21    "body": {
22      "action": "refreshtoken",
23      "client_id": "<your_client_id>",
24      "client_secret": "<your_client_secret_PRIVATE>",
25      "refresh_token": "<user_refresh_token>"
26    }
27  }
28}

With the Backend Workflow and API Connector configured, build the user-facing authorization flow. Build the Connect Withings button On your app's settings or profile page, add a Button element labeled Connect Withings. In its workflow, add a Navigate to an external website action with this URL: https://account.withings.com/oauth2_user/authorize2?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_CALLBACK_URL&scope=user.metrics,user.activity,user.sleepevents&state=CURRENT_USER_UNIQUE_ID Replace: - YOUR_CLIENT_ID with your actual Withings client_id - YOUR_CALLBACK_URL with your Backend Workflow URL (URL-encoded) - CURRENT_USER_UNIQUE_ID with a dynamic expression: Current User's Unique ID The scope parameter specifies which data types the user is authorizing. Common scopes: - user.metrics: weight, blood pressure, and other body measurements - user.activity: activity data (steps, calories) - user.sleepevents: sleep tracking data Verify current scope names at developer.withings.com as they may be updated. Store a Connected state on the User Add a boolean field withings_connected to the User Data Type. In the withings_oauth_callback Backend Workflow, after storing the tokens, add a step: Make changes to User → set withings_connected = yes. On the settings page, show a Connected badge if Current User's withings_connected is yes and a Connect Withings button if it is no. Handle the post-connection redirect After Withings redirects to your callback URL and the Backend Workflow fires, the user ends up on a blank URL. Add a redirect at the end of the withings_oauth_callback Backend Workflow: Navigate to the health dashboard page. This gives users a smooth experience after authorization.

1{
2  "Authorization URL": "https://account.withings.com/oauth2_user/authorize2?response_type=code&client_id=<CLIENT_ID>&redirect_uri=<CALLBACK_URL_ENCODED>&scope=user.metrics,user.activity,user.sleepevents&state=<CURRENT_USER_UNIQUE_ID>"
3}

Withings supports a push notification model: once subscribed, Withings POSTs a notification to your Backend Workflow URL whenever the user syncs a device measurement. This is more efficient than polling and delivers data to your app within seconds of a sync. Create the push notification receiver Backend Workflow In Backend Workflows, click New API Workflow. Name it withings_measurement_push. This workflow will receive POST requests from Withings whenever a user syncs a device. Withings push notifications do not send the full measurement — they send a notification containing the user's Withings user ID (userid) and a notification type (appli). You must make a separate API call to fetch the actual measurement after receiving the notification. Configure the workflow: Step 1: Add a URL parameter userid (Text) — Withings sends this in the push body. Step 2: Find the Bubble User where withings_user_id = URL parameter userid. Step 3: Call API Connector → Get Measurements using that User's withings_access_token as the Bearer token. Fetch the latest measurement (meastype 1 for weight, or whichever types you are tracking). Step 4: Create a HealthMeasurement record in Bubble with the measurement values and link it to the User found in Step 2. Create the HealthMeasurement Data Type In Data → New type → HealthMeasurement. Add fields: - measurement_date (Date) - type (Text): weight, systolic_bp, diastolic_bp, heart_pulse, spo2 - value (Number): the numeric measurement value - unit (Text): kg, mmHg, BPM, % - user (User) Add a Privacy rule: HealthMeasurement visible only when Current User is HealthMeasurement's user. Subscribe to push notifications After the user's OAuth token is stored, call the Withings notification subscribe endpoint to register your Backend Workflow URL. Add this to the withings_oauth_callback Backend Workflow as an additional step after storing tokens: Call API Connector → Subscribe Notifications (POST /notify action=subscribe): - callbackurl: your withings_measurement_push Backend Workflow URL - appli: 1 (for body measurements — verify current appli codes at developer.withings.com) - Bearer header: the new access_token just stored Withings will then POST measurement notifications to that URL every time the user syncs their device. RapidDev's team has implemented complete Withings push notification pipelines for health monitoring Bubble apps — if you need help with the full notification → fetch → store chain, book a free scoping call at rapidevelopers.com/contact.

1{
2  "Subscribe Notifications call": {
3    "method": "POST",
4    "url": "https://wbsapi.withings.net/notify",
5    "headers": {
6      "Authorization": "Bearer <access_token_PRIVATE>",
7      "Content-Type": "application/json"
8    },
9    "body": {
10      "action": "subscribe",
11      "callbackurl": "https://<your-app>.bubbleapps.io/api/1.1/wf/withings_measurement_push",
12      "appli": "1"
13    }
14  }
15}

With data flowing into Bubble via push notifications, build the health dashboard and implement token refresh. Build the dashboard page Create a page called health-dashboard. Add: - A section for the latest weight reading: Do a search for HealthMeasurements where user = Current User and type = weight, sorted by measurement_date descending, limit 1. Display the value and date. - A Repeating Group for weight trend (last 30 readings, one row per reading, sorted by date): bind to HealthMeasurement search filtered to type = weight. - A blood pressure section: two separate searches for systolic_bp and diastolic_bp, each displaying the most recent reading with a visual indicator for healthy vs. elevated ranges. - A chart plugin (ApexCharts by Zeroqode or similar) for the weight trend line. Handle token refresh Create a Backend Workflow called refresh_withings_token. Inside: - Call API Connector → Refresh Token (POST /v2/oauth2 action=refreshtoken) with the User's stored refresh_token as a dynamic value - Update User's withings_access_token with the response access_token - Update withings_token_issued_at to Current date/time On the health-dashboard page load workflow, add a conditional: If Current User's withings_token_issued_at is more than X hours ago (verify Withings access token TTL at developer.withings.com) — Schedule API Workflow: refresh_withings_token. This keeps the access token fresh for API calls made from the dashboard. Verify Privacy rules for HealthMeasurement Go to Data → Privacy → HealthMeasurement. Confirm the rule: When Current User is HealthMeasurement's user — all fields visible. Without this rule, any authenticated Bubble user can query another user's biometric data through Bubble's data API. Health measurement data is sensitive personal information and must be protected.