How to Integrate Lovable with Garmin Connect

Garmin's Health API is not self-serve — it requires applying to their developer program. Go to developer.garmin.com/gc-developer-program/overview/ and click 'Get Started'. You'll complete a form describing your application, intended use case (coaching platform, research, personal health app, etc.), and your organization. Garmin reviews applications and typically responds within 3-5 business days. Once approved, Garmin provides you with OAuth 1.0a credentials: a Consumer Key and Consumer Secret. These are different from OAuth 2.0 credentials — there's no client_id/client_secret separation, and the authentication flow uses HMAC-SHA1 signing rather than Bearer tokens. Garmin offers two API tiers: the standard Health API for end-user applications where users connect their Garmin accounts, and the Activity and Wellness API for personal developer use or research. For a coaching platform or multi-user app, you need the standard API with OAuth 1.0a user authorization. For accessing only your own Garmin data, direct API access is available. During the application, you must provide a webhook callback URL where Garmin will push data. Since you're building on Lovable, use your Edge Function's URL: https://your-project.supabase.co/functions/v1/garmin-webhook. Note that the Lovable preview URL won't work for Garmin webhooks — you need the deployed Supabase Edge Function URL from the Cloud panel.

Open your Lovable project, click '+', select 'Cloud', and expand Secrets. Add GARMIN_CONSUMER_KEY with your OAuth 1.0a Consumer Key and GARMIN_CONSUMER_SECRET with your Consumer Secret. Also add GARMIN_API_BASE with 'https://healthapi.garmin.com/wellness-api/rest' for the Health API base URL. Garmin's OAuth 1.0a authentication requires these credentials for every request signature. Unlike OAuth 2.0 where you exchange them once for a Bearer token, OAuth 1.0a requires signing each API request with both the Consumer Secret and the user's OAuth Token Secret. Store user tokens in a Supabase garmin_tokens table: user_id, oauth_token, oauth_token_secret, garmin_user_id. Garmin's push model means most data arrives via webhooks rather than direct API pulls. However, for fetching historical data (backfilling past activities for a new connection) and fetching specific data types on demand, you'll still make outbound API requests. These use the user's OAuth token alongside your Consumer Key. The webhook receiver doesn't require the consumer credentials for verifying incoming data — Garmin sends data without signature verification in the initial implementation, though more recent versions support signature headers. Validate incoming webhook data by checking for expected fields rather than cryptographic signature verification.

Garmin's push model requires a webhook receiver — an Edge Function that listens for POST requests from Garmin containing activity summaries, daily summaries, heart rate data, body composition updates, and sleep records. Garmin calls your registered webhook URL whenever new data is available for any connected user. The webhook payloads are JSON arrays containing multiple data records. An activity summary includes: summaryId, userId, activityType, startTimeInSeconds, durationInSeconds, distanceInMeters, avgHeartRateInBeatsPerMinute, maxHeartRateInBeatsPerMinute, totalKilocalories, trainingEffectLabel, and more depending on device capabilities. For daily summaries, Garmin sends: totalSteps, dailyMovementGoal, floorsClimbed, moderateIntensityDurationInSeconds, vigorousIntensityDurationInSeconds, wellnessStartTimeInSeconds, wellnessEndTimeInSeconds, and body battery data when available. The Edge Function should: validate the incoming payload has expected fields, map Garmin's user_id to your app's user_id (using a mapping table), upsert the data into your Supabase tables (activities, daily_summaries, sleep_summaries), and return a 200 OK response quickly. Process data asynchronously if the payload is large — Garmin may retry if your endpoint doesn't respond within a few seconds.

1// supabase/functions/garmin-webhook/index.ts
2import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
3import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
4
5const corsHeaders = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "POST, OPTIONS", "Access-Control-Allow-Headers": "Content-Type" };
6
7serve(async (req) => {
8  if (req.method === "OPTIONS") return new Response(null, { headers: corsHeaders });
9
10  const supabase = createClient(Deno.env.get("SUPABASE_URL") ?? "", Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "");
11
12  try {
13    const body = await req.json();
14
15    // Map Garmin user IDs to app user IDs
16    const getUserId = async (garminUserId: string): Promise<string | null> => {
17      const { data } = await supabase.from("garmin_user_mapping").select("user_id").eq("garmin_user_id", garminUserId).single();
18      return data?.user_id ?? null;
19    };
20
21    if (body.activitySummaries) {
22      for (const a of body.activitySummaries) {
23        const userId = await getUserId(a.userId);
24        if (!userId) continue;
25        await supabase.from("activities").upsert({
26          summary_id: a.summaryId,
27          user_id: userId,
28          activity_type: a.activityType,
29          start_time: new Date(a.startTimeInSeconds * 1000).toISOString(),
30          duration_seconds: a.durationInSeconds,
31          distance_meters: a.distanceInMeters ?? 0,
32          avg_hr: a.avgHeartRateInBeatsPerMinute ?? null,
33          max_hr: a.maxHeartRateInBeatsPerMinute ?? null,
34          calories: a.totalKilocalories ?? null,
35          training_effect: a.trainingEffectLabel ?? "",
36        }, { onConflict: "summary_id" });
37      }
38    }
39
40    if (body.dailySummaries) {
41      for (const d of body.dailySummaries) {
42        const userId = await getUserId(d.userId);
43        if (!userId) continue;
44        await supabase.from("daily_summaries").upsert({
45          summary_id: d.summaryId,
46          user_id: userId,
47          date: new Date(d.calendarDate).toISOString().split("T")[0],
48          steps: d.totalSteps ?? 0,
49          step_goal: d.dailyMovementGoal ?? 0,
50          floors: d.floorsClimbed ?? 0,
51          moderate_intensity_minutes: Math.round((d.moderateIntensityDurationInSeconds ?? 0) / 60),
52          vigorous_intensity_minutes: Math.round((d.vigorousIntensityDurationInSeconds ?? 0) / 60),
53        }, { onConflict: "summary_id" });
54      }
55    }
56
57    return new Response(JSON.stringify({ received: true }), { headers: { ...corsHeaders, "Content-Type": "application/json" } });
58  } catch (err) {
59    console.error("Garmin webhook error:", err.message);
60    return new Response(JSON.stringify({ error: err.message }), { status: 500, headers: corsHeaders });
61  }
62});

With data arriving via webhooks and stored in Supabase, build the performance dashboard. Because all data comes from Supabase (not direct Garmin API calls), the dashboard loads fast and works independently of Garmin's API availability. For coaches managing multiple athletes, the main view should show all athletes with their last activity date, current VO2 max (stored from webhook data), weekly training load, and recovery status (if available from body battery or HRV data). A quick visual indicator (green/yellow/red) shows who is ready to train and who may need rest. For individual athlete detail, show a 12-week training load trend, recent activities with type, distance, and key metrics, heart rate zone distribution for the current training block, and sleep quality trend if sleep data is being received. For activity-level detail, show the key metrics for each activity: duration, distance, average and max heart rate, average pace, calories, training effect label (base, aerobic, anaerobic, etc.), and training load score. Build a workout type distribution chart showing how time was split between run, bike, swim, and other activities. For RapidDev users building coaching platforms with complex multi-athlete views and automated training prescription features, RapidDev's team can help architect the data pipeline and dashboard.