Authentication
Cadence uses OAuth 2.0 (Authorization Code flow with PKCE) for user-context requests, and API keys for server-to-server calls. Every request requires authentication; unauthenticated requests return 401 Unauthorized.
API Key (server-to-server)
Generate API keys from your Cadence dashboard at /dashboard/api-keys. Keys are scoped to your coach account; they cannot access other coaches' data. Pass the key in the Authorization: Bearer ... header.
OAuth 2.0 (user-context)
Use OAuth for apps that act on behalf of a coach. Standard Authorization Code flow with PKCE.
Endpoints
Clients
List all active clients on your roster. Paginated, 50 per page.
Retrieve a single client's profile, current program, recent check-ins, payment history.
Create a new client (sends them an invite email with the install link).
Send a coach-to-client message (delivered in their app inbox).
Check-ins
List a client's submitted check-ins. Filter by date range with ?from=YYYY-MM-DD&to=YYYY-MM-DD.
Retrieve full check-in payload — photos, measurements, notes, RPE, wearable summary.
Programs
List programs assigned to a client (current + historical).
Create a new program (or trigger AI generation by passing { "ai_generate": true, "goal": "hypertrophy" }).
Webhooks
List your registered webhook endpoints.
Register a new webhook endpoint. See /cadence/integrations for the full list of supported events.
Remove a webhook subscription.
Rate limits
Rate limits are scoped to your coach account (not per-key). Limits are advisory — we'll send you a heads-up email at 80% utilization before any throttling. Burst capacity allows occasional spikes.
Idempotency
POST requests support an Idempotency-Key header. Pass a unique UUID per logical operation; if the request is retried with the same key within 24 hours, the API returns the cached response instead of duplicating the action. Strongly recommended for client-creation and program-assignment calls.
Error responses
All errors follow a standard JSON envelope:
Common HTTP status codes:
200OK — request succeeded201Created — resource created400Bad Request — malformed payload or validation error401Unauthorized — missing/invalid auth403Forbidden — auth valid but action not allowed404Not Found — resource doesn't exist409Conflict — idempotency key collision with different payload429Too Many Requests — rate limit exceeded; checkRetry-Afterheader5xxServer error — retry with exponential backoff
SDKs
Official SDKs ship for Node.js, Python, and Ruby. Community SDKs for Go and PHP are linked from our GitHub.
Frequently asked
cdnsk_test_* prefix. Test mode requests don't affect production data and don't trigger real Stripe charges or client emails./dashboard/api-keys. Coach-tier coaches: email us to join the waitlist.