COROS API integration

No. That is the point of the integration. We hold the COROS Open API registration, the client credentials and the redirect URI; you call POST /v1/connect with your own id for your own user and redirect their browser to the URL that comes back. There is no COROS secret in your environment, no callback route in your router, and no approval queue between you and your first connected athlete.

Two weeks free, then from 32.50 € a month billed annually — or 39 € a month with no year to commit to — for the whole API, every provider and every endpoint, with no per-athlete metering. Plans differ on one thing: how many of your users may connect a watch. Hacker is 250, for a project and its first users; Startup covers up to 5,000 of them; Scale up to 250,000; Enterprise removes the ceiling; and none of them meters calls, activities or endpoints. The usual price for a unified wearable API starts in the hundreds of dollars a month and charges again for each connected user, which is a pricing model that punishes exactly the thing you are trying to do. There is a 30-day money-back guarantee on any charge, and cancelling is a button in the Stripe billing portal; access ends when the period does.

You get push, not polling. When an athlete finishes a workout, COROS notifies us and we send you an activity.created delivery — sealed to your public key as a JWE and signed with a detached JWS you verify against our published JWKS. Latency is whatever COROS takes to process the upload from the watch, which is theirs to own and typically a matter of minutes. You never write a polling loop and never hold a rate-limit budget.

There is no API key anywhere in this, in either direction. You authenticate to us with an Ed25519 signature over the request itself — RFC 9421 HTTP Message Signatures — using a private key that never leaves your machine, so there is no bearer token sitting in a log line, a CI variable or a backup. And we never hand you the provider's own credentials either.

All of them, because the integration is with the COROS account rather than with a watch. Anything that syncs into a user’s COROS account reaches you — PACE, APEX, VERTIX, NOMAD and the DURA bike computer — and a model released next year works on the day it ships without a change on either side.

Usually the last 90 days, and sometimes years — the athlete decides, on COROS’s own consent screen. That screen carries a checkbox offering the app access to their previous workouts; left alone it grants 90 days, ticked it grants their whole history, and we walk back through it until COROS tells us to stop. Past workouts arrive through the same fan-out as live ones, so on your side they are ordinary activities with nothing marking them as historical. Two caveats worth designing around, and both are COROS’s rather than ours. The deep grant expires 24 hours after the athlete connects, so history is collected at once rather than being something you can offer as a setting later — and COROS serves only what was recorded on a COROS device, so a FIT the athlete imported into Training Hub from somewhere else never appears. There is no field telling us which of the two grants we got, so we cannot tell you in advance how deep a given user will go.