Bolt.new AI and Withings integration: Step-by-Step Guide 2025

To integrate Bolt.new with Withings, you don’t “connect Bolt to Withings directly.” Instead, you build a small web app inside Bolt.new that uses the real Withings REST API. Withings exposes an OAuth 2.0 flow for user authorization and then provides access tokens your Bolt app can use to call endpoints like body measurements, sleep, and activity data. Bolt.new gives you a browser-based development runtime where you create backend routes (usually Node.js + Express) that handle the OAuth callback, store tokens in environment variables, and make actual HTTP requests to the Withings API. The integration works exactly the same as any normal API integration — Bolt is just where you scaffold and test it.

 

What You Actually Do (High‑Level)

 

You create a tiny backend in Bolt.new that:

• Uses Withings’ OAuth 2.0 authentication to obtain an access token and refresh token.
• Stores those tokens in Bolt.new environment variables during development.
• Calls Withings’ REST endpoints using standard HTTPS requests.
• Optionally triggers jobs (e.g., fetch latest measurements) or serves them to a frontend.

No hidden magic. It’s the same pattern you’d use in any full‑stack stack: a backend route to begin OAuth, a callback to finish OAuth, then authenticated API calls.

 

The Actual Steps Inside Bolt.new

 

This is the real, correct process using the real Withings API.

• Create a new Bolt.new project using a Node.js + Express template.
• Go to the Withings Developer Portal, create an application, and get:
  - Client ID
  - Client Secret
  - Redirect URI (you will paste a Bolt route URL here)
• Put those secrets into Bolt.new environment variables:
  - WITHINGS_CLIENT_ID
  - WITHINGS_CLIENT_SECRET
  - WITHINGS_REDIRECT_URI
• Implement a route in your Bolt backend where users start OAuth (redirect to Withings).
• Implement a callback route where Withings redirects back with an authorization code.
• Exchange that code for access + refresh tokens using a real Withings token request.
• Call any Withings API endpoint via HTTPS with the bearer token.

 

Working Code Example (Node.js + Express)

 

This code is valid and uses the official Withings OAuth 2.0 flow exactly as documented.

import express from "express";
import fetch from "node-fetch";

const app = express();

// Load secrets from Bolt.new environment variables
const clientId = process.env.WITHINGS_CLIENT_ID;
const clientSecret = process.env.WITHINGS_CLIENT_SECRET;
const redirectUri = process.env.WITHINGS_REDIRECT_URI;

// Start OAuth: redirect user to Withings
app.get("/auth/withings", (req, res) => {
  const url = `https://account.withings.com/oauth2_user/authorize?response_type=code&client_id=${clientId}&redirect_uri=${encodeURIComponent(redirectUri)}&scope=user.metrics,user.activity,user.sleep`;
  res.redirect(url);
});

// OAuth callback from Withings
app.get("/auth/withings/callback", async (req, res) => {
  const code = req.query.code;

  // Exchange code for access + refresh tokens
  const tokenResponse = await fetch("https://wbsapi.withings.net/v2/oauth2", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      action: "requesttoken",
      grant_type: "authorization_code",
      client_id: clientId,
      client_secret: clientSecret,
      code: code,
      redirect_uri: redirectUri
    })
  });

  const tokens = await tokenResponse.json();

  // For development: show token; in production store safely (db/secrets manager)
  res.json(tokens);
});

// Example call: get body measures from Withings
app.get("/withings/measurements", async (req, res) => {
  const accessToken = process.env.WITHINGS_ACCESS_TOKEN; // temp storage in Bolt env

  const response = await fetch("https://wbsapi.withings.net/measure", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      action: "getmeas",
      access_token: accessToken
    })
  });

  const data = await response.json();
  res.json(data);
});

app.listen(3000, () => {
  console.log("Server running on port 3000");
});

 

Important Real‑World Notes

 

• Withings requires OAuth 2.0 Authorization Code flow; you cannot skip it.
• Bolt.new does not store tokens long term; move to a database when deployed.
• Use refresh tokens to obtain new access tokens automatically.
• API calls must include the access token in the JSON body, not the header.

 

How to Harden After Prototyping in Bolt.new

 

• Store tokens in a database (Postgres, DynamoDB, Firebase, anything real).
• Implement automatic token refresh using Withings grant_type=refresh_token.
• Add error handling for rate limits and expired tokens.
• Move secrets to a production secrets manager.

 

Summary

 

Integrating Bolt.new with Withings is simply integrating a Node.js backend you build inside Bolt with the official Withings OAuth and REST APIs. You scaffold an Express server, wire OAuth routes, store tokens in environment variables, and make authenticated HTTPS calls. This is the correct, real way to make the integration work.