All Google Health API endpoints that read and write user data require user
consent to that data collection through one or more scopes. The app
must provide the list of scopes when calling Google's OAuth2 auth endpoint. See
[Obtaining OAuth2 Access
Tokens](https://developers.google.com/identity/protocols/oauth2/web-server#obtainingaccesstokens).
The access token issued will only contain the scopes the consenting user has
authorized.

All Google Health API scopes begin with:

    https://www.googleapis.com/auth/googlehealth

## Implementation

To provide the best user experience and ensure security compliance, when
requesting scopes you should:

- Only request access to the specific data scopes your application requires to function, and explain the specific user benefit of each permission in an in-app disclosure before launching the OAuth consent screen.
- Only configure "write" access (for example, using a `writeonly` scope) if you are sending data to Google Health.
- Users have the right to grant granular permissions. Never crash, show a generic technical error, or render a blank screen if a user withholds one or more requested scopes:
  - **Partial consent (graceful degradation)** : If a user grants some scopes (for example, granting Heart Rate but withholding Steps), keep your application functional using the permitted data streams. Display inline, context-specific prompts explaining which features are limited and provide a direct link to [re-authorize missing
    scopes](https://developers.google.com/health/setup#update-scopes).
  - **Zero consent (fallback UI)** : If a user deselects all scopes, route them to a dedicated **Missing Permissions** screen that explains why the integration requires at least one permission (for example, *"For the
    best user experience, we recommend enabling all scopes"* ) and provide a prominent **Grant Scopes** button to re-launch the consent flow.
- Don't maintain duplicate in-app permission toggles that conflict with Google Consent settings. If a user revokes scope access through their Google Account, reflect that change in your app UI immediately.

## Available scopes

<br />

| Scope | Permission |
|---|---|
| .activity_and_fitness.readonly | See your Google Health activity and fitness data. |
| .activity_and_fitness.writeonly | Add activity and fitness data to Google Health, and edit or delete the data it adds. |
| .ecg.readonly | See your Google Health ECG data. |
| .health_metrics_and_measurements.readonly | See your Google Health health metrics and measurement data. |
| .health_metrics_and_measurements.writeonly | Add health metric and measurements data to Google Health, and edit or delete the data it adds. |
| .irn.readonly | See your Google Health Irregular Rhythm Notifications data. |
| .location.readonly | See your Google Health GPS location recorded during an exercise. |
| .logged_symptoms.writeonly | Add logged symptoms data to Google Health, and edit or delete the data it adds. |
| .mindfulness.writeonly | Add mindfulness data to Google Health, and edit or delete the data it adds. |
| .nutrition.readonly | See your Google Health nutrition data. |
| .nutrition.writeonly | Add nutrition data to Google Health, and edit or delete the data it adds. |
| .profile.readonly | See your Google Health profile data. |
| .profile.writeonly | Add profile data to Google Health, and edit or delete the data it adds. |
| .reproductive_health.writeonly | Add reproductive health data to Google Health, and edit or delete the data it adds. |
| .settings.readonly | See your Google Health settings. |
| .settings.writeonly | Add settings data to Google Health, and edit or delete the data it adds. |
| .sleep.readonly | See your Google Health sleep data. |
| .sleep.writeonly | Add sleep data to Google Health, and edit or delete the data it adds. |
[*Table: Google Health API scopes*]

<br />