# Counting Authorized Athletes for Strava API Applications at Scale

DevFeed: [Counting Authorized Athletes for Strava API Applications at Scale](<https://devfeed.tech/articles/ac-count-ing-for-scale-26569.md>)

Original publisher: [Read original article](<https://medium.com/strava-engineering/ac-count-ing-for-scale-becf9c27b104?source=rss----89d4108ce2a3---4>)

Author: jana

Published: 2023-04-26T18:23:14Z

Content type: article

Language: en

Sources: [Strava Engineering](<https://devfeed.tech/sources/strava-engineering.md>)

Topics: [API](<https://devfeed.tech/topics/api.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [data](<https://devfeed.tech/topics/data.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [applications](<https://devfeed.tech/tags/applications.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [data](<https://devfeed.tech/tags/data.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [scale](<https://devfeed.tech/tags/scale.md>), [strava](<https://devfeed.tech/tags/strava.md>)

## AI overview

Strava's API & Platform team needed to enforce per-application limits on the number of athletes authorized to connect. The article describes using OAuth2.0 refresh tokens and unique athlete IDs as a proxy for counting connected athletes, while noting the scalability challenge of counting rows in a SQL database.

## Source excerpt

Tens of thousands of API applications interact with Strava's publicly available API, from small projects whose only users are the developers who created them to larger partners like Garmin, Zwift, Wahoo, or Peloton, who upload thousands of activities to Strava daily on our athletes' behalf. Recently the API & Platform team undertook a project to redefine the way that Strava supports API applications and allows them to interact with Strava data (read more about the updated Developer program here). As part of the effort to redefine the management of API applications, a main requirement of the project asked that we be able to assign and enforce a limit to the number of athletes who are allowed to authorize an application on their behalf, what we called an application's athleteCapacity. On creation of a new application, the default athleteCapacity is a single athlete -- the application owner. Developers can subsequently apply to have their limits increased. In order to enforce the assigned athleteCapacity we needed to know how many athletes had authorized any given API application to read and write data to their Strava account, what we termed as an application's connectedAthletesCount. When a new athlete attempts to authorize an application on their behalf (as pictured below), we wanted to be able to ascertain whether the authorization would cause the connectedAthletesCount to exceed its athleteCapacity. The prompt shown to an athlete to request their permission to authorize an external application to connect to Strava on their behalf. We planned to perform the check of an application's `connectedAthletesCount` against its `athleteCapacity` on click of "Authorize". If authorization would cause the application to exceed its athleteCapacity, we would prevent the athlete from authorizing. Otherwise we would allow authorization to proceed. Our use of the OAuth2.0 standard for external access to our API gave us an easy proxy for determining the connectedAthletesCount. As part