--- title: "Fitbit to Google Health API: Developer Migration Timeline" canonical: "https://help.validic.com/space/VCS/5535203416/Fitbit%20to%20Google%20Health%20API%3A%20Developer%20Migration%20Timeline" format: markdown --- **Last Updated: June 25, 2026** ## Overview Google is replacing the Fitbit Web API with the Google Health API. This is not an update to the existing integration. It is an entirely new platform with new authentication, a new source type (`google_health`), and a required security verification process. The legacy Fitbit Web API shuts down permanently on September 30, 2026. The process is sequential: you build and test the integration first, then submit your Google Cloud Console app to production, which triggers OAuth verification. CASA cannot begin until OAuth verification is complete, and Google's team tells you whether it is required and at which tier based on your specific application. There is no public checklist for determining tier in advance. --- ## Key Dates | **Date** | **Event** | | --- | --- | | Now | Review minimum required scopes (developers.google.com/health/scopes); identify potential CASA assessors | | May 2026 | `google_health` integration available; Validic provides callback URL | | May 19, 2026 | Fitbit users must migrate their login to a Google Account or lose app access | | Mid to Late July 2026 (target) | Validic completes its own CASA assessment; clients may begin their CASA process **after this point** | | Late July 2026 (target) | Submit production app; OAuth verification process begins; user migration outreach starts | | September 30, 2026 (firm date) | Legacy Fitbit Web API shuts down permanently (hard deadline) | Both integrations run side by side from May through September 30, 2026. There is no planned downtime during the overlap period. --- ## Migration Timeline | **Track** | **May 1-12** | **May 13-19** | **May 20-31** | **June** | **July** | **August** | **September** | **October** | | --- | --- | --- | --- | --- | --- | --- | --- | --- | | **Scope review + assessor research** | Scope Review | | | | | | | | | **Phase 1: Enablement** | | *Enablement | | | | | | | | **Phase 2: Development (Inform sandbox)** | | | *Development | Development | | | | | | **Phase 3: Testing** | | | | Testing | Testing | | | | | **CASA: Validic Assessment** | | | | Validic CASA | Validic CASA | | | | | **Submit + OAuth Verification** | | | | | Client OAuth verification | Client OAuth verification | | | | **User Migration** | | | | | Migration begins | Migration | Migration | | | **CASA: Client Assessment (after Validic completes)** | | | | | | Client CASA Assessment | Client CASA Assessment | Client CASA Assessment | * **Note: The Google Health API was officially launched as part of Google I/O in May 2026. Follow ****[Validic Release Notes](https://help.validic.com/space/VRN)**** for updates. ** **Critical deadlines:** - May 19, 2026 - Fitbit user account migration deadline (users who have not migrated to a Google Account lose access) - September 30, 2026 - Legacy Fitbit Web API shuts down permanently CASA timing: The assessment takes 4 to 6 weeks and must be completed within 90 days of exceeding 100 users. If you go live in July and exceed 100 users immediately, the window closes in October. CASA cannot begin until OAuth verification is complete, and OAuth verification cannot be completed until you have a working production app. Identifying an assessor before you reach that point means you can move without delay when Google initiates the process. **Important: Validic must complete its own CASA assessment before clients can begin theirs.** Validic is targeting completion of its assessment in mid to late July 2026. Client CASA processes can begin after Validic's assessment is complete. Plan your timeline accordingly. --- ## Phase Details ### Before May - Scope Review and Assessor Research There is limited work to do before the integration is built and submitted. The two things worth doing now: - Review the Google Health scopes at [developers.google.com/health/scopes](https://developers.google.com/health/scopes) and determine the minimum set your application will need. Requesting only the scopes you actually need simplifies OAuth verification. - Currently supported scopes and endpoints - `settings.readonly` (required) - For user local UTC offset - `activity_and_fitness.readonly` (optional) - Validic Summary and Workout endpoints - `health_metrics_and_measurements.readonly`(optional) - Validic Measurement endpoint - `sleep.readonly`(optional) - Validic sleep endpoint - Note: - Intraday will be supported in a future development cycle and will use the `activity_and_fitness.readonly` scope - Nutrition will be supported in a future development cycle and will use the `nutrition.readonly `scope - IMPORTANT: Google suggests only requesting the scopes you will be using on the day you create the developer credentials. Don’t enable future scopes in our integration. When these are made available, you will be able to go back in and add scopes in the Google console. - All four Google Health API scopes Validic supports (settings.readonly, activity_and_fitness.readonly, health_metrics_and_measurements.readonly, sleep.readonly) are classified as restricted scopes by Google. That classification triggers two sequential requirements: - OAuth App Verification: Addressed when you have a production app. See the ‘Production Submit and OAuth Verification’ section below - CASA Security Assessment: Triggered when your Google Health developer credentials hit 100 connected users. - [Identify potential CASA assessors](https://appdefensealliance.dev/casa/casa-assessors) so you are not starting cold if Google requires an assessment. You cannot begin CASA until after OAuth verification, but knowing your assessor means you can engage immediately once Google notifies you. Everything else, OAuth verification materials, CASA tier, assessment scope, depends on having a working production app. Those steps cannot be completed in advance. ### Phase 1 - Planning and Enablement (May, approximately 1-2 weeks) - Validic will reach out with your callback URL and everything you need to request Google Health API developer credentials - Create your project in Google Cloud Console, select the minimum required scopes, and obtain your OAuth credentials (client ID and client secret) - Share your credentials with Validic via secure channel - Open a support ticket to request `google_health` be added to your Inform marketplace - Review the metric mapping guide to understand what has changed before writing code - Audit your codebase for any logic that filters, routes, transforms, stores, or displays data by source type ### Phase 2 - Development (approximately 2-4 weeks) Development happens against the Inform sandbox using the credentials from your Google Cloud Console project. - Update backend logic to handle `google_health` alongside `fitbit` during the overlap period (May through September); transition to `google_health` only after the legacy API shuts down - Update your marketplace UI to surface the new Google Health API integration - Adjust metric-specific logic where needed: some metric names have changed, some Fitbit metrics are not available in Google Health API, and some new metrics are available - Review the metric mapping guide for the full breakdown Nutrition data is not available in Google Health API. If your application consumes nutrition metrics from Fitbit today, plan how to handle their absence before development begins. ### Phase 3 - Testing (approximately 2-3 weeks) - End-to-end validation: records with `source.type = "google_health"` are ingested and processed correctly - Regression testing: existing `fitbit` connections continue to work during the overlap period - Validate downstream consumers: dashboards, reports, member-facing displays - Test the user connection flow through your marketplace - Confirm no data duplication between `fitbit` and `google_health` for the same user ### Production Submit and OAuth Verification (target: Late July) When development and testing are complete, submit your Google Cloud Console app to production. This is the step that triggers the OAuth verification requirement. - Submit your GCP app to production mode - Prepare verification materials: a live homepage on a verified domain, a privacy policy linked from the homepage and OAuth consent screen, domain ownership verified in Google Search Console, a demo video showing the complete OAuth flow with the consent screen displaying the requested scopes, and written justifications for each requested scope - Complete OAuth verification; Google's team reviews your scopes and application - Google notifies you whether CASA is required and at which tier for your specific project There is no public checklist for determining CASA tier in advance. Google evaluates each application individually. Do not assume a tier before receiving Google's notification. ### User Migration (target: Late July onward) - Consider removing the Fitbit integration from your marketplace at launch to prevent new users from connecting to the legacy integration - Communicate to your existing Fitbit users about reconnecting through Google Health API - Monitor reconnection rates using Validic's Connections API There is no way to silently migrate users to Google Health API. Google requires each user to individually sign in with their Google Account and grant permissions. This is a Google security requirement. Google Workspace accounts are not supported. Users need a personal Google Account. ### Fitbit Cleanup (after September 30, 2026) Remove remaining `fitbit` source type references from your codebase after the legacy API shuts down. --- ## CASA Security Assessment CASA (Cloud Application Security Assessment) is Google's required security review for applications accessing restricted health data. It cannot begin until OAuth verification is complete. ### Who needs it Applications accessing Google Health API data for more than 100 users require a CASA assessment. The assessment must be completed within 90 days of exceeding 100 users, and revalidation is required every year. ### Validic's CASA assessment and what it means for clients Validic must complete its own CASA assessment before clients can begin theirs. Validic is targeting completion of this assessment in mid to late July 2026. Client CASA processes cannot start until Validic's assessment is complete. This is a fixed dependency in the sequence and is not something clients can work around or accelerate on their own. Factor this into your planning: if your application is likely to exceed 100 users quickly after launch, the window between Validic's completion and your 90-day CASA deadline will be tight. Identify your assessor now so you are ready to engage immediately. ### How the process works - CASA cannot begin until OAuth verification is complete - After OAuth verification, Google's Trust and Safety team contacts you directly if CASA is required - Google assigns the tier based on your scopes, user count, and risk factors; clients cannot self-select a tier, and there is no public checklist to determine it in advance - The assessment is conducted by one of Google's authorized labs. Upon passing, your application receives a Letter of Validation (LOV) ### Why identify an assessor before you reach this step The assessment takes 4 to 6 weeks once it begins. If your application goes live in July and you exceed 100 users quickly, the 90-day window closes in October. OAuth verification itself takes time, which compresses the window further. Identifying an assessor now means you can engage immediately once Google notifies you rather than losing time to assessor selection and queue delays. ### CASA Accelerator If your organization holds SOC 2 or ISO 27001 certification, the CASA Accelerator may reduce the scope of your assessment. Confirm with your assessor whether you qualify. ### Authorized Assessors [Google maintains an authorized assessor](https://appdefensealliance.dev/casa/casa-assessors) list through the App Defense Alliance. Assessors include Bishop Fox, KPMG, Leviathan Security, NCC Group, and others. The full list is available at the CASA Assessors page on the App Defense Alliance site. --- ## Additional Notes - Subscribe to the Validic status page for integration updates: [trust.validic.com/incidents/8lzmtg20hp90](http://trust.validic.com/incidents/8lzmtg20hp90) - If your integration uses the Validic v1 (legacy) API, contact Validic Support before beginning this migration; Google Health API is not supported on v1 - The metric mapping guide (available at launch) provides a full resource-by-resource and metric-by-metric comparison between Fitbit and Google Health API Questions? Contact your Validic account team or open a support ticket at [help.validic.com/portal/2](http://help.validic.com/portal/2).