User Connect API requires authentication by JWT put into AUTHORIZATION header with standard Bearer prefix. JWT itself is a standard EGYM ID token, which is user-based. All User Connect API is user-based and provides third parties restricted access which can be revoked by user in EGYM ID settings. Different kinds of integrations to provide third parties with these JWTs are implemented. Basic case means EGYM provides third party with 1 hour lived auth token and forever-lived refresh token.
We force to use HTTPS only. Calls made over plain HTTP will fail.