How to Scrape Strava in 2026 (API & Python)

Strava is not a platform where you can quietly scrape around the rules — it runs a documented OAuth 2.0 API at developers.strava.com, and its Terms of Service separately and explicitly ban "screen scraping" and "crawlers" against the website itself. In mid-2026, ahead of a confidential IPO filing, Strava tightened both further: it added a flat developer fee, deprecated several API endpoints, and login-gated data that used to be visible to anyone. This guide covers the official API's real scope and limits, why DIY scraping is a bad idea here, and how a structured API can return public route, club, and challenge data — never a specific athlete's private activities or location history.

Why scrape Strava data?

• Route and trail research — surface the most popular hiking, running, and cycling routes in a region for a fitness app, guidebook, or outdoor-gear site.
• Club and community analytics — track club size, growth, and location for run/ride club discovery or sponsorship research.
• Challenge and event tracking — monitor Strava's current public challenge gallery for seasonal fitness-marketing trends.
• Fitness-app market research — benchmark what competing apps and clubs look like in a given sport or region.
• AI/LLM pipelines — feed public route and club summaries into agents that answer "best hiking trails near X" style queries.

Is it legal to scrape Strava?

Option 1: Strava's own official API (and its limits)

The official Strava API v3 is OAuth 2.0-based: your app redirects an athlete through Strava's consent screen, and Strava issues a token scoped to that athlete. Segment and route data was historically visible to any authenticated app, but Strava has been steadily narrowing that:

• Per-athlete scope. Without a specific athlete's OAuth grant, you can only fetch data about yourself (useful for testing). Getting data on other users requires each of them to individually authorize your app.
• Rate limits. New apps start in "single-player mode" at roughly 200 requests/15 minutes and 2,000/day; scaling past 10 connected athletes requires an app review, after which limits rise to around 400/15 minutes and 4,000/day.
• 2026 deprecations. Per the official changelog, the Club Activities, Club Members, and Club Admins endpoints are being removed on September 1, 2026, and the Explore Segments endpoint is being restricted to an approved "Extended Access Tier" the same day. A new API base URL (api-v3.strava.com) replaces the old one starting January 4, 2027.
• New developer fee. As part of the same June 2026 changes, Strava introduced a flat monthly fee for API access (reported at roughly $11.99/month), replacing the previously free tiered program.
• No AI training, no bulk export, no re-display of other users' data. These restrictions were added to the API Agreement in late 2024 and remain in force.

If your use case is "let an athlete connect their own Strava account to my app," the official API is the right and only sanctioned tool. It is not designed for building a general dataset of routes, clubs, or athletes across the platform.

Option 2: DIY in Python (and why it breaks)

Nothing stops you from pointing requests or a headless browser at Strava's public pages — but Strava's own Terms of Service ban exactly that, and its robots.txt fully blocks known AI crawlers (GPTBot, Google-Extended, ClaudeBot, Meta-ExternalAgent are all disallowed site-wide). Beyond the legal risk:

• Login walls. As of the June 2026 changes, data that used to render for anyone — including club listings — now requires a logged-in session, so an unauthenticated scraper sees far less than it used to.
• Anti-bot defenses. Strava has been actively hardening its site against scrapers ahead of its IPO, so expect fingerprinting, rate limiting, and IP blocking on top of the ToS risk.
• No stable public JSON. The route, club, and challenge pages are server-rendered HTML, not a documented API, so selectors break on redesigns.

Given the explicit ToS prohibition, DIY scraping of Strava is a materially different risk profile than the DIY sections in our other how-to-scrape guides — plan accordingly.

Option 3: A structured Strava API

For public route, club, and challenge data — never a specific athlete's private activities, GPS traces, or login-gated content — a Strava scraping API can return normalized JSON from Strava's public route explorer, club profile, and challenge gallery pages. Browse routes by sport, country, and region:

curl "https://api.crawlora.net/api/v1/strava/routes?sport=hiking&country=usa&region=colorado" \
  -H "x-api-key: $CRAWLORA_API_KEY"

The same call in Python:

import requests

resp = requests.get(
    "https://api.crawlora.net/api/v1/strava/routes",
    headers={"x-api-key": "YOUR_API_KEY"},
    params={"sport": "hiking", "country": "usa", "region": "colorado"},
)
routes = resp.json()["data"]["routes"]
for r in routes[:5]:
    print(r["rank"], r["name"], r["distance_raw"], r["difficulty"])

A response is a ranked route index (fields are illustrative — check the docs for the current schema):

{
  "code": 200,
  "msg": "OK",
  "data": {
    "sport": "hiking",
    "country": "usa",
    "region": "colorado",
    "title": "Top 318 hiking trails in Colorado",
    "total_pages": 16,
    "total_results": 318,
    "routes": [
      {
        "rank": 1,
        "name": "Mallory Cave via N.C.A.R. Trail",
        "path": "hiking/usa/colorado/boulder/mallory-cave_5171952737974445730",
        "difficulty": "Easy",
        "distance_raw": "1.46 mi",
        "elevation_gain_raw": "345 ft"
      }
    ]
  }
}

Pull the full detail for one route using the path from the index:

curl "https://api.crawlora.net/api/v1/strava/routes/detail?path=hiking/usa/colorado/boulder/mallory-cave_5171952737974445730" \
  -H "x-api-key: $CRAWLORA_API_KEY"

Look up a club's public profile by id, or pull Strava's current public challenge gallery:

h = {"x-api-key": "YOUR_API_KEY"}
base = "https://api.crawlora.net/api/v1/strava"

club = requests.get(f"{base}/clubs/521703", headers=h).json()["data"]
print(club["name"], club["member_count"], club["location"])

challenges = requests.get(f"{base}/challenges", headers=h).json()["data"]
print(challenges["promoted_challenge"]["name"])

What you can collect

This is scoped to public route, club, and challenge listings — not any athlete's private activity feed, GPS traces, or friends list:

• Route index and detail — name, sport, difficulty, distance, elevation gain, estimated time, and description for public routes by sport/country/region.
• Club public profile — name, location, member count, verification status, and description for a club id — the same fields visible on a club's public page, not its member roster or activity feed.
• Public challenge gallery — Strava's current promoted and category challenges (name, goal, duration), the same list shown on strava.com/challenges.

Limitations

• No private athlete data, ever. No individual activities, GPS routes ridden by a specific person, heart rate, or friends/followers — that data requires that athlete's own OAuth consent through Strava's official API.
• Strava's terms restrict automated collection. Treat this as a higher-risk category than most platforms in this series — review Strava's API Policy and Terms of Service yourself before scaling any collection.
• Login-gating is expanding. Following the June 2026 anti-scraper push, more of what used to be visible without an account may move behind a login over time, which can reduce what any public-page-based source can reach.
• Not a bulk athlete-activity export. If your use case needs individual athletes' training data, that only exists through the official OAuth API with each athlete's consent — there is no legitimate shortcut around that.

Where this gets used

• Outdoor and fitness content — surface top-rated regional trails and routes for travel or gear sites.
• Club discovery and sponsorship research — find and size run/ride clubs by location for community partnerships.
• Fitness-marketing trend tracking — monitor which challenges Strava is promoting by sport and season.

Sources

Start collecting

Try it first, free: run any public URL through the Free Web Scraper, or check whether a site blocks bots with the Anti-Bot Checker — no signup.

Test the routes endpoint in the Playground, check the current response schema in the API docs, and review credit costs on the pricing page. If you're comparing fitness and activity platforms, pair this with how to scrape Instagram for a brand's social presence, or how to scrape Google Maps for the local businesses around a popular trailhead. Before you build anything that runs at scale, read is web scraping legal in 2026? — Strava's own terms are stricter than most.

Part of our how-to-scrape guide series — every platform we cover, in one index.