WHOOP data, in your own stack.
Users connect their WHOOP account over OAuth. Open Health Sync pulls cycles, recovery, sleep and workouts on a schedule and when WHOOP sends a webhook.
- Source
- Strap
- How the data arrives
- Cloud API v2, OAuth 2.0, scheduled pulls and webhooks for recovery, sleep and workouts.
What it collects.
Each record maps to the same model as every other source, with the provider, source and device it came from.
- Cycles, with strain
- Recovery: score, resting heart rate, HRV (RMSSD), SpO2, skin temperature
- Sleep, with stage durations
- Workouts
- Body measurements
How it works.
- 01
The user connects
Your server asks for a consent URL and sends the user to WHOOP. Tokens are stored encrypted.
- 02
The server pulls
A first backfill, then scheduled pulls, and webhooks where the provider sends them. Every raw payload is kept.
- 03
You read one model
Units, time zones and duplicates handled, served over REST, the read-only MCP server and FHIR R4.
Before you start.
- Bring your own app from the WHOOP Developer Dashboard.
- The public API has no raw heart rate series, no hypnogram and no ECG, so neither does this connector.
Set it up.
Register your own WHOOP app, set its callback to <OHS_PUBLIC_URL>/oauth/whoop/callback and put its credentials in .env. The guide has every step.
# .envOHS_WHOOP_CLIENT_ID=...OHS_WHOOP_CLIENT_SECRET=...# Ask for a consent URL, then send the user to authorize_urlcurl -s -X POST $OHS/v1/users/$USER_ID/connections/whoop \ -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' \ -d '{"redirect_uri":"https://app.example.org/connected"}'# Read what came incurl -s "$OHS/v1/users/$USER_ID/sleep" -H "Authorization: Bearer $KEY"Questions.
Can I use WHOOP with Open Health Sync today?
Yes. The WHOOP connector ships in v0.1.0.
Do I need anything from WHOOP?
Bring your own app from the WHOOP Developer Dashboard.
Where does the data go?
Only to the server you run. Open Health Sync is self-hosted software, not a service: no account with us and no call home. Each user can be deleted with one call, raw files included.