Strava's 2026 Developer Program Changes: API Pricing, Subscription & MCP

On June 1, 2026, Strava announced a batch of changes to its developer program, the same day it launched its MCP Connector. It also published a new API Agreement and a separate API Policy, both effective that day. Some of the changes have already happened, and the rest have dates attached.

1. API access now requires a Strava subscription

TechCrunch described it as a flat $11.99 monthly fee for all developers. Strava's API FAQ says there's no additional fee: the subscription itself provides access to the API. Strava's getting-started page puts it more bluntly: a subscription is a prerequisite for creating an app. That's the regular Strava subscription, which Strava lists at $11.99 a month or $79.99 a year in the US, with prices shown in local currency elsewhere. The subscription sits on your own Strava account. It isn't a separate charge for each app.

For new developers it took effect on June 1, 2026. Existing Standard Tier developers had until June 30, 2026, and active developers without a subscription got three months free. Apps in the Extended Access Tier (approved for 10,000 or more athletes) don't need a subscription, and Strava says wearable and device integrations aren't affected. On why, Strava's support FAQ says the subscription lets it add subscription features to the MCP and the API, and helps deter people who would exploit the API.

2. Tiers, athlete caps and rate limits

Every app now starts in what Strava's rate limits page calls “Single Player Mode”: an athlete capacity of 1. From the API Settings Dashboard you can self-upgrade to 10 athletes without a review. Past 10, the app needs Strava's review, and until it passes you can't authenticate more athletes. A reviewed Standard Tier app can grow to 9,999 users. At 10,000 or more, with approval, it moves into the Extended Access Tier, which Strava says brings prioritized developer support, higher rate limits, greater user capacity and eligibility for its Partner APIs. Strava also moved all current and future apps to the Standard Tier automatically, which it says eliminated the old review queue.

Default rate limits are 200 requests every 15 minutes and 2,000 a day overall, and 100 every 15 minutes and 1,000 a day for non-upload endpoints. After the self-upgrade to 10 athletes, the overall limit is 400 per 15 minutes and 4,000 a day, and the read limit is 200 per 15 minutes and 2,000 a day.

3. Club endpoints removed, Explore Segments restricted

On September 1, 2026, Strava removed the Club Activities, Club Members and Club Admins endpoints, per the API changelog. Strava's June 1 post gave the reason: their community engagement didn't support their maintenance. The same day, Explore Segments became available only to approved Extended Access apps with a qualifying use case.

The June 1 changelog entry also added a new deauthorization endpoint, showed each app's access tier in the API Settings Dashboard, and introduced the self-service upgrade that takes a new app from 1 athlete to 10, with higher rate limits, without a review.

4. What's due in 2027

• Tokens in headers. From June 1, 2027, authorization tokens must be sent in request headers, not form parameters.
• Deauthorization moves to /oauth/revoke. The authentication docs say /oauth/revoke will be the only supported deauthorization endpoint from June 1, 2027, when /oauth/deauthorize is retired. It uses HTTP Basic auth and takes a token plus an optional token_type_hint.
• New base URL. The changelog says the base URL is changing from https://www.strava.com/api/v3 to https://api-v3.strava.com, available from January 4, 2027. Strava's June 1 post lists the change under June 1, 2027 and spells the host a little differently; the changelog is the one to follow. No Strava page gives a shutdown date for the old URL.

5. The new API Policy, and the scraping backdrop

Strava's June 1 post gives its own reasons. It says AI companies are “aggressively attempting to scrape platforms for training data, abuse APIs through intermediary layers, and provide zero-code AI tools that produce apps that hammer APIs,” and that developer applications to its program were up 448% year-to-date.

TechCrunch reported that Strava is putting some formerly public pages behind a login. CEO Michael Martin told TechCrunch that AI companies are “ruthlessly scraping public websites” and that Strava had turned down AI labs asking to license its data. Separately, Strava announced on February 2, 2026 that it had confidentially submitted a draft IPO registration statement.

Two rules from Strava's November 2024 API update carried into the new API Policy that took effect June 1, 2026, and one of them got much wider:

• Display data only to its owner. Section 2.3: Strava data from a specific user may be displayed or disclosed in your app only to that user.
• No AI use outside Strava's MCP. Under Section 5.3, API data can't be used to develop, train, evaluate or operate any AI application. That includes retrieval-augmented generation and putting it into a model's context window or working memory. The only exception is Strava's own MCP.

The Policy adds more. Section 5.16 bans routing Strava data through integration platforms, no-code AI platforms, pass-through proxies, intermediaries or aggregators, and running any MCP server or similar agent interface that exposes Strava data. Section 5.5 rules out persistent indexes such as vector stores. Section 6.2 caps caching at seven days, and Section 6.3 requires deletions to show up within 48 hours.

When it changed its API Agreement in November 2024, Strava said the changes would affect fewer than 0.1% of applications, with coaching platforms and tools that help users understand their data still permitted. For the 2026 changes, its support FAQ says 140 multi-user apps, 0.06% of all apps, needed changes.

6. MCP for AI access

Strava's answer to AI access is the Model Context Protocol (MCP), an open-source standard for connecting AI apps to outside data and tools. Its MCP product is the consumer-facing Strava MCP Connector, which launched June 1 and lets subscribers query their own data through Claude.

It isn't something developers can build on. Section 3.5 of the Policy makes the Strava MCP the only authorized first-party agent interface and says it can't be used for commercial or third-party access outside the developer's own personal use. The API FAQ says apps that expose athlete data to third-party AI tools won't be approved for higher access. More on the connector and what it can reach is on the Strava MCP page.

What this means for developers

• Keep an active Strava subscription on the account that owns your app, unless the app is in Extended Access.
• If you're past 10 athletes, or plan to be, submit the app for review.
• Before June 1, 2027: tokens in headers, /oauth/revoke for deauthorization, and the new base URL.
• Confirm your app only shows a user's data back to that same user, and that no API data reaches an AI model in any form, not just training.
• If you want AI analysis of your own data, use Strava's MCP Connector with a subscription. An app that sends other athletes' Strava data to an AI model isn't allowed, and neither is running your own Strava MCP server or piping data through an intermediary platform.

To see which listed apps still connect after these changes, check the Strava app status page. New to the platform? Start with the Strava API getting-started guide and the developer documentation, covering authentication, webhooks, and best practices.