Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

TLS fingerprinting blocks third-party clients

mitchl

I'm a software developer and over the years I've made a few scripts and tools to collect, parse, analyze, and otherwise interact with my data on Garmin Connect. Most recently, I was interested in using an MCP server to give LLMs access to my data. There are already a few options available, but most of them have been broken by a recent server-side change. Apparently, Garmin is now using Cloudflare TLS fingerprinting, which breaks most/all non-browser clients. That means we can no longer (easily) interact with the Connect REST APIs.

This is really disappointing to me as a customer. The data I record on my devices and store on Garmin Connect are my data, and I expect to be able to access it via reasonable means for whatever purpose I want to use it for. Garmin customers, including myself, made a lot of noise in support of Garmin when Strava recently brought a frivolous lawsuit over patents and data usage. But whether or not it was intentional, this change makes me feel like Garmin is now gatekeeping access to my own data in a similar manner.

I do understand that there are costs associated with running the platform, and there need to be controls in place to prevent malicious misuse or excessive requests from badly-behaved clients. But if that's the primary concern, it's time for Garmin Connect to provide a real, documented public API with OAuth support and the ability for any developer to create a new client for personal use.

  • 0

    Interestingly, today the developer program is "under construction"

    https://www.garmin.com/en-US/forms/GarminConnectDeveloperAccess/

  • 0

    Upvote this!
    I've worked on an mcp that builds me a personalised training plan right into my garmin account and onto my watch (blog post ) and it only still works because I still have active access tokens. But this won't work for others that try to auth today. I've tried to get this project approved by Garmin and to get API keys but they rejected on the basis that it's not "an enterprise app". A lot more interesting open sourced features will organically appear if they open their APIs to the wider world.

  • 0 in reply to rodtrent

    Interesting. I applied for their old program but they rejected on the basis that my project was not  "an enterprise app". 

  • 0 in reply to rodtrent

    Right when I started to develop a swimming workout creator app to quickly upload workouts I've built I've hit this wall. What a pain. I really wish companies like this would allow us to use the platform APIs without having to jump through hoops. How can I even request a developers account now?

  • 0

    If at least the Fit-file activities were automatically saved to a cloud drive (e.g., Dropbox), as is possible with competitors, that would be a first step towards having easy access to the logged activities data.
    I can understand that Garmin doesn't want its own platform acting as an analysis tool for the competition, but this is about our own data, logged with Garmin devices, and we should have easy access to it. Especially as more and more data is exchanged via cloud-services

  • 0

    If Garmin wanted to give us ordinary users access to their API, they would have done that many years ago. But they didn't because that probably is not the purpose of the API. As  hinted, it is meant for integration with enterprise applications. And it is probably charged for.

    What do you folks think? Are you, just like me, considering alternative vendors? Which ones? Do you have any experience with Polar devices? Thanks for any advice and suggestions!

  • 0 in reply to Aleš

    I am not going to throw out my good watch because of this but my next device won't be garmin. My sons have been asking for a smart watch so I will also be looking somewhere else for that.

  • 0 in reply to 4229263

    Garmin does sync with Strava for free and there are many projects to query the Strava APIs. that could be an option but not ideal given that it's not the source of truth and there are data points that probably don't get synced.

  • 0 in reply to bsan

    Yes, but as you said, unfortunately Strava doesn't pass through the original FIT files. For example running and cycling dynamics data fields, developer messages and much more are lost in the process. At least that was the case until recently, unless something has changed.

  • 0 in reply to rodtrent

    the form is back but the "under construction" message is still there. top QAing there.