Skip to content

Changelog

New features and changes on the SweatStack platform, by release.

0.147.0 (2026-10-30)

Added

  • Write many dailies (beta). You can now send up to 1,000 values of one measure in one request with POST /api/v1/dailies/{measure}/batch; it never replaces a stored value and says per value whether it was written. See Write many dailies.
  • Compressed uploads. POST /api/v1/activities/upload now accepts .fit.gz and .csv.gz files, stored as the plain file. See Send compressed files.
  • The app that wrote a source. A source your app uploads now carries your app as application_id, relayed or not, and your app can delete it. See Read the result per file.
  • X-Total-Count in browsers. A browser app can now read the X-Total-Count header of GET /api/v1/sources. See Get the outcome by polling or by webhook.

Changed

  • Who wrote a daily. A daily an app writes now has source: "application" and the app's application_id, and source may gain values, so treat an unknown one as valid; the Python library does from version 0.98.0. See Who wrote a daily.
  • source on markers and max efforts (beta). Markers and max efforts now always say who wrote them: manual for the athlete, application for an app, where source was null. See Storing markers.

0.145.0 (2026-10-29)

Added

  • Passkeys for developer accounts. SweatStack now asks for a passkey before sensitive actions on your apps, such as creating an app or changing its credentials, redirect URIs or webhooks. Signing in does not change, and your apps keep running whether or not you have a passkey. See Protect your developer account.

Changed

  • Passkey confirmation on the developer endpoints. When POST /api/v1/applications or an endpoint that changes an app's page or provider keys needs your passkey, it answers 401 with WWW-Authenticate: Bearer error="insufficient_user_authentication", or 403 second_factor_enrollment_required if your account has no passkey. With CLI 0.14.0 or later, run sweatstack login and then the command again. See Authentication.

0.144.0 (2026-10-29)

Changed

  • Your own words on the Pages fast track. The fast track now fills in the website and a purpose for each kind of data only where you have not, and both stay yours to edit; only the privacy policy is locked. SweatStack's privacy policy for client-side apps now comes only with the fast track. See Take the Pages fast track.

Fixed

  • Unknown activity and trace ids. GET /api/v1/activities/{activity_id}/data, /mean-max and /accumulated-work-duration and GET /api/v1/traces/{trace_id} now answer 404 for an id that does not exist, or no longer does, instead of 500.

0.143.0 (2026-10-29)

Added

  • A security log for your app. The new Security tab of your app's settings lists every change to its client secrets, redirect URIs, webhooks, default scopes and own provider keys, and when it went live, with who made it and when. See Read the security log.
  • Last use in Privacy settings. Your users now see, for each app they connected, what it can see and when it last used its access.
  • Suspended apps. A suspended app gets invalid_client from the token endpoint and 403 application_suspended from the app users token endpoint; its refresh tokens work again when the suspension is lifted. See If your app is suspended.

0.142.6 (2026-10-28)

Changed

  • Refresh tokens end after a year unused. A refresh token you have not used for 365 days is now refused with invalid_grant; each refresh restarts the year, so an app that refreshes at least once a year is unaffected. See Token lifecycle.

0.142.5 (2026-10-28)

Changed

  • Derived clients stay within your app's access. GET /api/v1/oauth/principal-token and POST /api/v1/oauth/delegated-token now return tokens with no more than your app's granted scopes, and their refresh tokens refresh like your app's own: with your client_id, and your secret if your app uses one. A client derived before this release has to be derived again. See Act as another user.
  • API keys act within their scopes. An API key or an app's access token is now refused with 403 by the applications and Pages endpoints and by principal-token, and nothing is derived from an API key. See Use an API key.

0.142.0 (2026-10-27)

Changed

  • Bring your own keys on Garmin's OAuth 2.0. Own keys for Garmin Connect now takes your Garmin app's consumer key with its OAuth 2.0 secret, which is what Garmin issues for every app today; enter the card's Redirect URL where your Garmin app's settings ask for one. See Bring your own keys.

0.141.0 (2026-10-27)

Added

  • Bring your own keys for Garmin. You can now turn on Own keys for Garmin Connect on the new Data sources tab of your app's settings and register your Garmin consumer key: the Garmin button on your sign-in screen then runs on it, Garmin's consent screen shows your app's name, and whoever signs in that way becomes a user of your app, while SweatStack still receives Garmin's data, runs the backfill and sends workouts with your key. See Bring your own keys.
  • login_hint on the authorization request. An email address you send as login_hint now fills in the email field when SweatStack asks the user for one. See Authorization request parameters.

Changed

  • Your own logo on the Pages fast track. The Logo URL on the Consent screen tab is yours to set on a Pages app that went live through the fast track; it used to be locked to the Pages icon. An empty one still gets that icon. See Publish a Page.

0.140.0 (2026-10-27)

Added

  • Relaying files your app received. POST /api/v1/activities/upload now takes an external_id per file, so sending the same file again is one activity, replace=true processes it again from a new file, and DELETE /api/v1/sources/{id} or DELETE /api/v1/sources?external_id= removes it with its activities; such sources have origin application and echo external_id and provider. See Relaying files your app received.
  • Portal links for users that belong to your app, and a profile destination (beta). A Portal link created for a user your app manages now signs them in, once and for a few minutes, since they have no account to sign in with; POST /api/v1/portal/sessions accepts profile, a Portal page where any user edits their name and sees their email. See Creating a Portal session.
  • Users that belong to your app (beta). Your app can now create users of its own and act for them without the athlete present: POST /api/v1/applications/{client_id}/users creates one, POST .../users/{user_id}/token returns a token for them, and the list, get, patch and delete calls complete the set, all authenticated with your client credentials over HTTP Basic. Such a user signs in to your app only and is deleted with it. See Choosing how athletes connect.

Changed

  • Developer terms at go-live. The save that takes your app live now asks you to accept the developer terms (Part B) and the Data Processing Agreement on behalf of the organization that operates it, once per version of those documents; until then go_live_missing lists it as developer_terms, and a live app whose terms changed gets a line on its pages instead of being switched off. See Going live.
  • Faster token exchange. Checking a client secret at POST /api/v1/oauth/token now takes 250 to 400 ms less.

Deprecated

  • Refresh without the client secret. If your app exchanged the code with its client secret, send that secret with every refresh too. SweatStack still accepts a refresh without it, but a later release will refuse it. See Refresh the access token.

0.139.0 (2026-10-26)

Changed

  • The legal documents have moved. The terms, the privacy policy, the Data Processing Agreement and the sub-processor list are now served by the platform at app.sweatstack.no/legal/terms, /legal/privacy, /legal/dpa and /legal/sub-processors, with every version at its own address and the date it took effect. The old sweatstack.no addresses redirect. The discovery documents name them (op_tos_uri, op_policy_uri). See Data ownership.
  • AI rules in the developer terms. The terms in effect from 2026-10-26 add rules for apps that put user data into a general-purpose AI model: get the user's explicit consent, name the AI provider, use only providers that don't train on the data, and don't train such a model on data from SweatStack unless it serves only that user. Your app must also follow the conditions that individual data sources set, which are listed on Data sources and provenance. See AI models.
  • Final invoice when Pro ends. When an app's Pro subscription ends, SweatStack now sends one last invoice for the MAU of its final billing period. See Pricing.

0.138.0 (2026-10-16)

Added

  • Authorization endpoint in the API reference. GET /oauth/authorize and the parameters your app sends to it are now in the OpenAPI document and the API reference. See Authorization request parameters.

Removed

  • created_at on markers and max efforts (beta). Rows from /api/v1/profile/markers and /api/v1/profile/max-efforts no longer carry created_at; date is when a value holds. See Storing markers.

Fixed

  • Timestamps without an offset. created_at on sources, including the POST /api/v1/activities/upload response, registered_at on users and in userinfo, and backfill_loaded_until now end in Z, like every other time the API returns as UTC. Before, they had no offset, which made activity uploads in the Python SDK fail. See Read the result per file.

0.137.0 (2026-10-15)

Added

  • go_live_missing (beta). POST /api/v1/applications and the application object in the page endpoints' responses now list what is missing before anyone but you can connect to your app: the empty profile fields, then a purpose for each category your app requests by default. See Create a page.
  • Redirect URI test. You can now paste the redirect_uri your app sends on your app's OAuth tab and see whether sign-in accepts it, and why. See Test a redirect URI.

Changed

  • Your app's page. Your app's settings are now on eight tabs that each save their own settings, and the Consent screen tab is the only place your app goes live, with a live preview beside the form. See Find your way around your app.
  • Pages fast track. The fast track is now on the Consent screen tab and also fills in a standard purpose for each category your app uses; it can't request the email address. See Take the Pages fast track.
  • Your own consent screen. If SweatStack would refuse anyone else the request you are making to your own app, your consent screen is now always shown, even when your earlier grant covers the request or you send prompt=none, and it says what to fill in. See Check your own consent screen.

0.136.0 (2026-10-14)

Changed

  • Apps missing a purpose. A user connecting to your app while it has no purpose for a category it requests now sees "Your app isn't released yet", whose button returns them to your redirect URI with error=access_denied and your state; your own consent screen names the categories that send everyone else there. See What makes a good purpose.

0.135.0 (2026-10-14)

Added

  • Beta label in the API reference. Every beta endpoint's summary now ends in "(beta)" and its operation in the OpenAPI spec carries x-beta: true, so your tools can tell a beta endpoint from a stable one. See API reference.

Changed

  • Consent is skipped by default. GET /oauth/authorize without prompt now sends a user who already granted your app these scopes straight back with a code, and shows the consent screen only for something new; prompt=consent shows it regardless. See Authorization request parameters.

Deprecated

  • prompt=none as the way to skip consent. Omit prompt instead: you get the same skip, and a user who still has to sign in or consent still sees the page. A later release will make prompt=none behave as OpenID Connect specifies, returning login_required or consent_required to your redirect URI when it cannot skip. See Authorization request parameters.

0.134.2 (2026-10-14)

Fixed

  • Connecting to an app that sends data:read. Since 0.134.0, a user connecting to such an app for the first time was told the app was not ready to connect; the consent screen now lets them through, as it did before. Users who had already connected were not affected.

0.134.0 (2026-10-13)

Added

  • Scopes per category. Scopes are now categories of information with a verb: activities:read, wellness:read, reproductive_health:read, workouts:write, sharing:read and their counterparts, plus the OpenID scopes openid, profile and the new email. Request only what your app uses; the user sees one line per category. See Scopes.
  • Purposes. Under What your app uses in your app's settings, write why your app needs each category; the user reads it under that category on the consent screen. Required once anyone but you can connect. See What makes a good purpose.
  • Consent screen preview. The edit form's Preview the consent screen opens the screen your users will see, for the scopes and purposes you are typing, without saving.
  • Incremental consent. A request for a scope the user has not granted yet shows only the new lines, and the grant grows; a request for fewer scopes never shrinks it. See Consent grows, it never shrinks.
  • Metabolic map (beta) for vo2 publishes vo2max_relative, the same VO2max in mL/kg/min. See The markers.

Changed

  • GET /api/v1/oauth/userinfo needs the openid scope; the name claims need profile and email needs the email scope, as OpenID defines them. An app that still sends data:read with profile keeps getting all of them.
  • GET /api/v1/profile/status needs no scope: any valid token reaches it, and its issue follows the token's scopes.
  • Delegated tokens never carry more than the token they were minted from, and never email, sharing or offline_access; a refresh re-issues exactly the scopes it was minted with. See Acting for someone else.
  • Account status (beta). The dailies capability is now wellness, and its issue codes are wellness_not_granted and wellness_no_source, the same word as the scope that reaches it. See Understand issues and capabilities.
  • Dailies follow your app's days of history, like activities.
  • Daily measures (beta) on the account status page and in capabilities are listed under wellness.
  • Curve responses (beta). Every curve names its intensity after the metric, in JSON as in Parquet: GET /api/v1/profile/intensity-duration-model/{metric} returns {duration, power} or {duration, speed} points, and the longitudinal accumulated work duration returns a power or speed column with its durations in seconds, also with format=json. See Metabolic profile and Accumulated work duration.
  • Accumulated work duration (beta). Both endpoints take metric as power or speed, as mean-max does, and return its values as 32-bit floats. See Accumulated work duration.
  • Longitudinal data column types. GET /api/v1/activities/longitudinal-data now returns the column types of an activity's data, so speed is a 32-bit float that every Parquet reader can open and a sample's temperature an integer. On both endpoints, a metric an activity didn't record is a null column of that metric's type. See Longitudinal data columns.

Deprecated

  • data:read and data:write. An app registered before this release may keep sending them until 13 April 2027; they are read as the categories they reached. Request the categories your app uses instead. An app registered after this release gets invalid_scope. See Before October 2026.
  • capabilities on POST /api/v1/applications is replaced by default_scopes; it is still accepted and translated, and echoed as a derivation of default_scopes, until the end of the same window.

Fixed

  • Accumulated work duration (beta) no longer returns a row with an empty intensity when an activity in the range didn't record the metric.

0.132.0 (2026-10-12)

Changed

  • Transition sessions. In a multisport file, a session shorter than 10 seconds no longer becomes an activity.

Fixed

  • CSV uploads with a decimal value in an integer column (100.5 as heart rate) failed; the value is now rounded.

0.131.0 (2026-10-09)

Added

  • App capabilities (beta). Declare the data your app uses in its settings, and issue reports only problems with that data. See Choose the data your app uses.

Changed

  • Issue codes (beta). issue.status is action_required or syncing, and activities_blocked_upstream, dailies_no_source and workouts_no_source are new codes. See Understand issues and capabilities.

0.130.0 (2026-10-08)

Changed

  • Portal sessions (beta). issue now carries destination, which you pass to POST /api/v1/portal/sessions with the user's access token and a return_url to create a Portal link. See Creating a Portal session.

0.127.0 (2026-10-08)

Changed

  • FIT parsing. New uploads are parsed by Pyroparse, the open-source parser SweatStack maintains: respiration rate is in breaths per minute, pool swims get distance, speed and cadence, and device names follow the file's manufacturer and product.
  • Mean-max curves of new uploads are computed exactly at every duration, and a pause in the recording no longer counts as effort. Values can differ from before by a few percent at some durations. See Mean-max.

0.126.0 (2026-10-07)

Changed

  • Activity data Parquet. GET /api/v1/activities/{id}/data and /activities/{id}/accumulated-work-duration serve float16 columns as float32 and carry no storage metadata. See Reading the Parquet outside the Python SDK.

0.125.0 (2026-10-06)

Added

  • Marker provenance (beta). Every marker on the metabolic map is null or {value, provenance}, where provenance is modeled, measured, declared or external. See Provenance.
  • Stored markers (beta). POST /api/v1/profile/markers/{marker} stores a value an athlete, a coach or a device provided, and a fresh test result outranks the model. See Storing markers.
  • Max efforts (beta). POST /api/v1/profile/max-efforts stores an all-out effort the athlete knows they can hold, and the fit uses it. See Max efforts.
  • Heart-rate zones (beta). GET /api/v1/profile/zones/heart_rate and /profile/metabolic-map/heart_rate work for any root sport, from the athlete's resting and maximum heart rate. See Zones.

0.124.0 (2026-10-02)

Added

  • Menstrual cycle tracking. The menstrual_cycle_day daily counts from 1 on the first day of a period, loops at the athlete's cycle length with interpolate=true, and 0 means the athlete isn't cycling. See Track the menstrual cycle.

0.123.0 (2026-09-29)

Changed

  • Laps. GET /api/v1/activities/ returns laps: null; GET /api/v1/activities/{id} and /activities/latest include them. In the Python SDK, list frames lose their laps.* columns; see the SDK changelog.

Fixed

  • Activities with more than 127 laps failed to import. They import again; upload an affected file again or re-sync the integration.

0.122.0 (2026-09-29)

Added

  • Zones (beta). GET /api/v1/profile/zones/{metric} returns an athlete's zones as absolute values: power and speed in three_zone, five_zone or seven_zone, RPE on the CR10 or Borg scale. See Zones.

0.118.0 (2026-09-28)

Added

  • Critical power and critical speed (beta). GET /api/v1/profile/metabolic-map/{metric} returns an athlete's thresholds (critical_power or critical_speed, second_threshold, max_aerobic_power or max_aerobic_speed, fatmax) fitted from the last 90 days of training, and GET /api/v1/profile/intensity-duration-model/{metric} the fitted curve at the durations you ask for. See Metabolic profile.

Changed

  • Breaking: mean-max curves are one row per duration. GET /api/v1/activities/{id}/mean-max and /activities/longitudinal-mean-max return duration, the metric and start per row, at 19 durations from 1 s to 6 h by default, durations=all or your own list. This affected one app, which is the only reason we made the change. We worked with them before the release.

0.117.0 (2026-09-28)

Added

  • Brand color. Pick a brand color on your app's settings page and the sign-in, consent and Portal pages take it; it is returned as brand_color on your application. See Optional: a brand color.

Changed

  • App settings page. One OAuth 2.0 card holds everything an integrator needs: client ID and secrets, the pre-filled authorization URL, the token URL, redirect URIs and scopes. See Credentials.

Deprecated

  • published on applications. The field on POST /api/v1/applications responses is deprecated, and sending it is ignored.

Removed

  • The App Directory. The /apps page is gone. Going live is unchanged: fill in the four profile fields and anyone with your authorization link can connect. See Going live.

0.116.0 (2026-09-25)

Changed

  • Webhook retries are per endpoint, on a fixed ladder of eight attempts over about twelve hours, and a 4xx other than 408 and 429 is final. See Response time requirement.

0.115.0 (2026-09-25)

Changed

  • Garmin permissions in your sign-in flow. A user who signs up through your app with Garmin's history or activity-export permission off is told so right after Garmin's screen and can go back to switch it on. See The flow.
  • "Confirm your email" carries your app's name and logo and links back to your app.

0.114.0 (2026-09-24)

Added

  • Why a user has no data (beta). GET /api/v1/oauth/userinfo carries issue: null, or one {code, status, message} whose message is one sentence that fits a banner. See Why does this user have no data?.
  • Account status (beta). GET /api/v1/profile/status returns the same issue plus capabilities (activities, activity_history, dailies, workouts, each ready, syncing, action_required or unavailable). See Check one capability.
  • The SweatStack Portal for data connections (beta). A SweatStack-hosted page in your branding where a user connects a source or grants a permission, then comes back to your app. See The Portal.
  • Sign in with SweatStack in your branding. The sign-in and consent screens carry your app's name, and a user whose wearable shares no email address is asked for one on the consent screen. See Sign in with SweatStack.
  • One wearable, no chooser. Add integration=garmin_connect (or intervals_icu, wahoo) to the authorization URL to send the user straight to that provider. See Send users straight to one provider.

0.112.0 (2026-09-03)

Added

  • Upload results. POST /api/v1/activities/upload returns one source per file, processing or failed with a named reason; get the outcome from GET /api/v1/sources/{id} or the source_processed and source_failed webhooks. See Uploading files.

Changed

  • CSV uploads carry their sport in a sport column; the sport upload parameter is gone. See CSV format.
  • Unknown sports are rejected on write. Creating a test or trace, or uploading a CSV, with a sport that isn't an Open Sport Taxonomy code returns 422 invalid_sport. See Sports.
  • OAuth2 errors and scopes. The token response includes scope, token failures return RFC 6749 bodies (401 invalid_client, 400 invalid_grant), and scopes are space-delimited. See the OAuth2 quick reference.

Deprecated

  • Comma-delimited scope. Commas are still accepted; use spaces.

0.111.0 (2026-08-13)

Added

  • Workouts: cycling, swimming, power and heart-rate targets (beta). Scheduled workouts accept cycling and pool swimming, with power and heart-rate targets and zones; PUT /api/v1/workouts/schedule/{id} updates a workout, and DELETE also removes it from the athlete's Garmin calendar. See Supported SWF subset.

0.110.0 (2026-08-06)

Added

  • Native-app redirect URIs. App registration accepts claimed https, loopback http and private-use schemes like com.example.myapp://oauth/callback; public plain http:// and URIs with a fragment are rejected. See Redirect URIs and Build a native mobile app.

Changed

  • PKCE. An authorization started with a code_challenge must be completed with its code_verifier; a client_secret in its place is rejected. See PKCE.

0.109.0 (2026-08-06)

Changed

  • Breaking: timestamps are UTC, and writes carry their own offset. start, end and trace timestamp serialize as UTC with a Z suffix, with the local wall-clock in start_local, end_local and a timestamp_local column. Creating or updating a trace or test, and the CSV timestamp column, must use offset-aware datetimes; a naive value is a 422. This affected four apps, which is the only reason we made the change. We worked with each of them before the release. See Timezones.
  • Date ranges are local dates. start and end on the list endpoints match each record's own local date. See Date-range filtering.

0.103.0 (2026-06-16)

Added

  • Fatigue-state mean-max. GET /api/v1/activities/longitudinal-mean-max accepts a repeatable after: the mean-max over the part of every ride after that much work (kJ) or distance (m), up to 5 states, with the date range capped at one year. See Longitudinal mean-max.

0.102.0 (2026-06-16)

Changed

  • Breaking: sports follow the Open Sport Taxonomy. Every sport value is an OST code, like cycling.road or cycling+stationary, and six values changed. This affected six apps, which is the only reason we made the change. We worked with each of them before the release. See Sports.
    • cycling.trainer is cycling+stationary
    • running.treadmill is running+stationary
    • cycling.tt is cycling.time_trial
    • cycling.mountainbike is cycling.mountain
    • cross_country_skiing is xc_skiing
    • unknown is generic
  • Faster longitudinal queries. /activities/longitudinal-data and /activities/longitudinal-mean-max are substantially faster over large date ranges.

0.97.0 (2026-06-05)

Added

  • Garmin Health dailies. Resting heart rate, HRV, sleep, body mass and body fat fill in from Garmin Health, with backfill. See Dailies.

Changed

  • Dailies status and source. Responses separate status (stored, estimated, missing) from source; GET /api/v1/dailies/{measure} returns stored values by default, and interpolate=true adds estimates. See Interpolation.

0.96.0 (2026-06-05)

Added

  • The SweatStack Portal for coaches (beta). Request a Portal link in your branding where a coach creates teams, invites athletes and views rosters. See The Portal.

0.91.0 (2026-05-22)

Added

  • Scheduled workouts (beta). POST, GET and DELETE /api/v1/workouts/schedule push structured workouts to Garmin Connect; running with pace targets in this first version. See Workouts.

0.83.0 (2026-04-22)

Added

  • Team listing. GET /api/v1/teams/ lists the teams you own or belong to; GET /api/v1/teams/authorized lists the teams you authorized to access your data. See the Teams API.

0.82.0 (2026-03-27)

Added

  • Dailies. Body mass, resting heart rate, HRV and sleep have their own API. See Dailies.
  • Tests. Lactate, VO2max and FTP tests are a first-class record, and traces carry vo2 in mL/min. See Tests.
  • App metadata. Attach per-app JSON to activities, traces and users with PUT /api/v1/{entity}/app-metadata: 1 KB on activities and traces, 4 KB on users. See App metadata.
  • Roller skiing is a sub-sport of cross-country skiing.

0.80.0 (2026-03-13)

Added

  • Date ranges and multiple sports on longitudinal endpoints. /activities/longitudinal-mean-max and /activities/longitudinal-accumulated-work-duration accept start, end and a repeated sport. See Longitudinal mean-max and Across a date range.

Deprecated

  • date and window_days on the longitudinal endpoints. Use start and end.
  • Plural sports on every endpoint. Use a repeated sport.

0.78.0 (2026-03-12)

Added

  • CSV upload. POST /api/v1/activities/upload accepts .csv alongside .fit. See CSV format.
  • Team-delegated tokens. POST /oauth/delegated-token accepts team_id, so a team member gets a delegated token for a user authorized to the team. See the Teams API.
  • Team users. GET /api/v1/teams/{team_id}/users lists the users authorized to a team.

0.76.0 (2026-02-25)

Added

  • Go-live flow. /applications/{id}/publish walks you through making your app public, and an app hosted on SweatStack Pages gets a one-click path. See Going live.

0.75.0 (2026-02-24)

Added

  • List your applications. GET /api/v1/applications returns the applications you own.

0.74.0 (2026-02-13)

Added

  • Delete an app. You can delete applications you own. See Delete an app.

0.73.0 (2026-02-12)

Added

  • Refresh tokens for public clients. Request the offline_access scope to get a refresh token. See Scopes.

0.72.0 (2026-02-12)

Added

  • Create applications via API. POST /api/v1/applications creates an application, for local development workflows. See Create an app.

0.71.0 (2026-02-11)

Added

  • Pages static assets. Upload static assets for your application's SweatStack Page. See Deploy files.

0.70.0 (2026-02-10)

Changed

  • Faster timeseries queries. Activity data responses are 50 to 70% smaller and faster to read.

0.68.0 (2026-01-23)

Changed

  • Passwordless sign-in. SweatStack signs users in with magic links by email; passwords are gone. Verification emails name the app that triggered registration.

0.67.0 (2026-01-07)

Added

  • Custom durations on mean-max. The durations parameter requests specific durations. See Mean-max.

0.66.0 (2026-01-07)

Added

  • Private apps. An app without a complete public profile is private: only you can authorize it. See Going live.

0.65.0 (2026-01-05)

Added

  • Managed users. Create and manage users on behalf of someone else, like a coach managing an athlete's account. See the Users API.

0.61.0 (2025-12-23)

Added

  • Teams. Group users and applications, and manage permissions across several parties. See the Teams API.

0.54.0 (2025-12-09)

Added

  • Garmin Connect permissions. Integration responses include the user's Garmin permissions, and SweatStack warns when the historical-data-export permission that enables backfill is missing. See Integrations.

For the Python SDK's release history, see the SDK changelog.