Strava Webhooks

When to Use This Skill

• How do I receive Strava webhooks?
• How do I set up a Strava push subscription?
• How do I implement the Strava subscription validation (GET hub.challenge) handshake?
• Why is my Strava subscription creation failing / callback validation failing?
• How do I handle Strava activity and athlete events?
• How do I detect a Strava athlete deauthorization?

How Strava Webhooks Differ

Strava push events are NOT cryptographically signed — there is no per-event signature, HMAC, or shared-secret header to verify on each POST. Authenticity is established once, at subscription time, via a GET handshake: