# Helios API, MCP, and OAuth for developers

Helios Health makes Helios, a fitness app for workouts, nutrition, and training notes. Use these developer resources to connect an agent, inspect the API contract, or check service availability.

## Developer resources

- [Helios REST API and permissions](/docs/api/): Read the authentication guide, OAuth scope list, public request limits, and version policy.
- [Helios OpenAPI specification](/openapi.json): Inspect REST operations, input and response schemas, session authentication, and MCP OAuth scopes.
- [Helios MCP tools](/docs/mcp-tools/): Read the tool guide for workout plans, training history, nutrition, and notes. Connect an authorized MCP client to https://api.getheliosapp.com/mcp.
- [Helios OAuth resource metadata](https://api.getheliosapp.com/.well-known/oauth-protected-resource/mcp): Find the MCP resource URL, authorization server, and supported scopes.
- [Helios OAuth server metadata](https://api.getheliosapp.com/.well-known/oauth-authorization-server/api/auth): Find authorization, token, and client registration endpoints for authorization code with PKCE.
- [Helios agent setup](/agents/): Choose a client setup guide. Sign in and approve only the permissions needed for the task.
- [Helios API health](https://api.getheliosapp.com/health): Check public availability and API version information without account access.

## Authentication and access

Personal records require authentication and account access. REST client endpoints use a Helios session cookie. Agents use the OAuth-protected MCP server. An MCP bearer token does not replace a REST session cookie. Read before a change, show proposed changes for approval, and keep the same request UUID when retrying a write.

## Rate limits

Public health and OpenAPI requests share a separate quota of 120 requests per 60 seconds per client IP. Read RateLimit-Policy and RateLimit to find the current policy, remaining requests, and reset time. An HTTP 429 response includes Retry-After. MCP has its own account-and-client quota. See the API guide for exact behavior and fault handling.

[Agent instructions](/llms.txt) · [API version policy](/docs/api/#versioning-and-deprecation-policy) · [Contact support](/contact/)