This article provides a complete explanation for support, implementation and customers who want to connect InBody to FITsociety through LookinBody Web/LB Web. Only publish this article after the InBody integration has been made visible to the appropriate customer group.

Summary

The InBody integration lets FITsociety retrieve body measurements from an InBody device and save them to the correct member. The integration does not use OAuth. There is therefore no "log in with InBody" button where a member grants permission themselves. An InBody/LB Web account is connected for each company using:

• an InBody account name/account ID;

• an InBody API key;

• a fixed FITsociety webhook URL;

• a webhook secret;

• an IP allowlist at InBody for our outbound API calls.

After installation, FITsociety can:

• automatically link members to InBody users by phone number, with additional checks against email address and date of birth when InBody returns them;

• automatically process new measurements when InBody sends a webhook;

• retrieve all existing InBody measurements for linked members;

• save values such as weight, BMI, body fat percentage, fat mass, muscle mass, total body water and BMR to existing FITsociety measurements;

• save a PDF result to the member if InBody includes a PDF URL or base64 PDF in the API response.

Important: InBody's current API documentation does not list a separate PDF/report endpoint. PDFs can only be saved automatically if InBody includes the PDF itself in the measurement data response.

Who is this integration for?

The integration is intended for companies with their own InBody/LB Web account that want to see InBody measurements under the correct member in FITsociety.

The integration is company-specific. Each FITsociety company gets its own installation, API key/account configuration and webhook URL. This keeps each company's data separate.

What do you need before connecting?

Make sure these requirements are ready before activating the integration.

IP allowlist

According to its response, InBody does not support hostname-based allowlisting. api.fitsociety.io therefore cannot be allowlisted as a hostname for outbound API calls.

For InBody, FITsociety's fixed outbound IP address must be allowlisted:

3.123.63.205/32

Where do you configure InBody in FITsociety?

In FITsociety, go to:

Bedrijfsinstellingen > Plugins / Integraties > InBody

Direct route:

/company/settings/plugins/inbody

The page is called Set up InBody and contains the fields and buttons explained below.

Fields on the InBody settings page

Account

Enter the InBody/LB Web account name or account ID here.

Examples:

<inbody-accountnaam><lbweb-account-id>

Use the exact account name provided by InBody. If this field is incorrect, FITsociety cannot call the InBody API.

API key

Enter the InBody API key here.

The API key is stored encrypted. After saving, we no longer display the API key in the interface. If the key needs replacing, enter a new API key and click Save setup.

API base URL

Normally this is set to:

https://eur.developers.lookinbody.com

For sandbox/testing, it is set to:

https://eur.developers.lookinbody.com/sandbox

For a real customer, normally use the live URL.

Environment

Choose:

• Live for real customer data;

• Test for sandbox/test data.

Please note: InBody sandbox mode may return demo data from some read endpoints, but some create/update/delete actions may still change real LB Web data. Use test mode deliberately.

Buttons on the InBody settings page

Save setup

This button saves the InBody configuration:

• account ID;

• API key;

• API base URL;

• environment;

• installation details;

• webhook secret if one does not exist yet.

After saving, FITsociety creates a company-specific webhook URL and webhook secret. The webhook secret is only displayed immediately after creation or renewal. Copy it straight into the InBody webhook settings.

Renew webhook secret

Only use this button if the existing webhook secret needs replacing.

After renewal, the old secret no longer works. The webhook setting in InBody must also be updated with the new secret.

Link members automatically

This button attempts to link FITsociety members to InBody users automatically.

FITsociety uses the member's phone number to query InBody through the official endpoint:

POST /User/GetUser

Several phone number formats are tried. For example:

062436680562436680531624366805+31624366805310624366805+310624366805003162436680500310624366805

A member is only linked automatically if the match is safe and unique:

• a phone number is available;

• the same phone number is not assigned to several local members;

• InBody returns exactly one user;

• if InBody returns an email address, it must match the FITsociety email address;

• if InBody returns a date of birth, it must match the FITsociety date of birth.

If there is any doubt, the member is not linked automatically and support or the coach must check this.

Retrieve all measurements

This button retrieves all available InBody measurements for linked members.

What happens technically:

1. When the button is used at company level, FITsociety first attempts to link members automatically.

2. All linked InBody users are then processed.

3. For each linked user, FITsociety retrieves all available InBody timestamps through:

POST /InBody/GetDatetimesByID

1. For each timestamp, FITsociety retrieves the full measurement data through:

POST /InBody/GetFullInBodyDataByID

1. FITsociety converts the InBody timestamp to a UTC measurement time.

2. FITsociety maps the values to existing FITsociety measurement types.

3. FITsociety saves the measurements to the member.

4. If the response includes a PDF, it is saved to the member's documents.

This button does not create duplicate measurements. Existing InBody measurements are upserted based on:

• company;

• member;

• measurement type;

• measurement time;

• source inbody.

If an earlier InBody import was incomplete, a new full sync can add or update measurement values without creating duplicate rows.

Setting up the webhook in InBody/LB Web

InBody must send a webhook to FITsociety after every measurement. The webhook is only a trigger. FITsociety does not trust the webhook body as definitive measurement data; it uses the webhook to call the official InBody API afterwards.

Webhook Name

Use a clear name, for example:

FITsociety - <bedrijfsnaam>

Webhook URL

Use the webhook URL FITsociety displays on the InBody settings page.

Without a query secret, it looks like this:

https://api.fitsociety.io/public/v1/webhooks/inbody/<installatiesleutel>

If InBody does not support custom headers, use the webhook URL with the secret in the URL:

https://api.fitsociety.io/public/v1/webhooks/inbody/<installatiesleutel>?secret=<webhook-secret>

Always use the URL from FITsociety itself. Do not retype the installation key manually unless necessary.

Custom Header

If InBody supports custom headers, use a header secret rather than a query secret.

Header name:

x-fitsociety-inbody-secret

Header value:

<webhook-secret>

The webhook secret comes from FITsociety and is only displayed after you save the setup or renew the secret.

What happens after a new InBody measurement?

1. The member steps onto the InBody device.

2. The member enters their phone number or InBody user ID on the device, depending on how the InBody account is configured.

3. InBody processes the measurement in LB Web.

4. InBody sends a webhook to FITsociety.

5. FITsociety checks the installation key and webhook secret.

6. FITsociety immediately returns 202 Accepted to InBody.

7. In the background, FITsociety retrieves the measurement data through the InBody API.

8. If the webhook contains a userID and datetimes FITsociety imports that exact measurement.

9. If the webhook does not contain a specific timestamp, FITsociety checks today's measurements for linked members.

10. FITsociety saves the values to the member's progress measurements.

11. The measurements become visible in the member profile under progress/measurements, provided the measurement type is enabled for that member. Newly imported InBody measurement types are automatically added to the member settings.

Which measurement values do we retrieve?

FITsociety retrieves values when InBody includes them in the full-data response and a corresponding measurement type exists.

Not every InBody device or account always returns every value. If InBody does not include a value, FITsociety cannot save it.

Where are the measurements stored?

The values are saved as regular FITsociety measurements under the member.

The measurements have the source:

inbody

The note on the measurement is:

Imported from InBody

The measurements then appear in the member's progress view, like other measurement values.

How does linking members work?

FITsociety stores an external InBody link for each member. This link consists of the InBody userID.

Automatic linking works as follows:

1. FITsociety checks all members of the company.

2. Phone number variants are generated for each member.

3. FITsociety queries InBody for the user with each phone number variant.

4. If exactly one InBody user matches, that candidate is checked.

5. If the email address or date of birth differs, no link is created.

6. If the match is safe, the InBody userID is saved to the member.

No automatic link is created in these cases:

• no phone number;

• multiple local members with the same phone number;

• multiple InBody users for the same phone number;

• different email address;

• different date of birth;

• no InBody user found.

What if members are already linked?

If a member already has an active InBody link, it is preserved. Automatic linking counts this member as already linked and does not simply overwrite it.

A manual or technical link can be saved again if support deliberately changes the InBody user ID.

What happens if measurements already exist?

FITsociety does not create duplicate InBody measurements for the same measurement type and measurement time.

When importing again, FITsociety uses an upsert. This means:

• if the InBody measurement does not exist yet, it is created;

• if the InBody measurement already exists, the existing row is updated;

• missing measurement types can still be added;

• a PDF can be linked later if InBody makes it available later.

This matters for historical imports and corrections.

PDFs of InBody measurements

Unfortunately, this is currently not possible. We have submitted a request to inBody. If you would like to share these digitally with your members, you can currently add them to documents manually. You can also contact inBody to ask whether they will ever support this.

What does the integration not do?

The current InBody integration does not provide the following:

• an OAuth flow where members log in through InBody themselves;

• automatic registration of FITsociety as a Connected App in LB Web;

• automatic configuration of the webhook in InBody;

• a guarantee that PDFs are available while InBody does not include a PDF in the API response;

• synchronization of payments or subscriptions;

• sharing data between different FITsociety companies.

Security and data separation

The integration is separated by company:

• each company has its own InBody installation;

• each installation has its own installation key;

• each installation has its own webhook secret;

• API keys are stored encrypted;

• webhook secrets are stored as hashes;

• measurement data is stored with the correct companyId and clientId;

• imports are logged separately by company, installation, InBody user and timestamp.

Errors in webhook or import processing are reported to Sentry without raw API keys, webhook secrets or authorization headers.

Common problems

The InBody integration is not visible

The InBody integration may be private/in a pilot. Check whether the company is allowed to use the InBody provider and whether the integration is available in the plugin list.

InBody shows "Connection failed" during the webhook test

Check:

• does the webhook URL exactly match the one displayed by FITsociety?

• is the customer using https://api.fitsociety.io/... rather than the Elastic Beanstalk backend URL?

• is the webhook secret entered correctly?

• does InBody support custom headers? If not, use the URL with ?secret=<webhook-secret>;

• has the webhook secret been renewed without updating InBody?

• is InBody or a network layer blocking the outbound test?

Please note: the IP allowlist is needed for our outbound calls to InBody. The webhook call from InBody to FITsociety uses the webhook URL.

No members are being linked

Possible causes:

• members do not have a phone number in FITsociety;

• phone numbers in FITsociety are incorrect or duplicated;

• InBody uses a different phone number/user token;

• InBody does not return a user through /User/GetUser;

• the email address or date of birth differs.

No measurements are being retrieved

Check:

• has the InBody setup been saved?

• is the API key correct?

• is the account ID correct?

• has FITsociety's fixed outbound IP been allowlisted at InBody?

• are any members linked?

• are there measurements in InBody for those linked users?

• does /InBody/GetDatetimesByID return timestamps?

Only weight is coming through

This can happen if InBody returns different field names than expected or if only weight is enabled in the member settings.

FITsociety now also maps full-data keys such as BMI(BodyMassIndex), PBF(PercentBodyFat), SMM(SkeletalMuscleMass) and BMR(BasalMetabolicRate). Then run Retrieve all measurements again to complete existing imported measurement times.

Support checklist for a new customer

Use this checklist for a new InBody installation.

1. Check whether the InBody provider is visible/available to the company.

2. Ask the customer or InBody for the LB Web account name/account ID.

3. Ask the customer or InBody for the API key.

4. Have InBody allowlist FITsociety's outbound IP:

3.123.63.205/32

1. Open the InBody plugin page in FITsociety.

2. Enter Account .

3. Enter API key .

4. Leave API base URL set to live unless this is a sandbox.

5. Choose Live for a real customer.

6. Click Save setup.

7. Copy the webhook secret immediately.

8. Copy the webhook URL.

9. In InBody/LB Web, enter:

Webhook Name: FITsociety - <bedrijfsnaam>Webhook URL: <webhook-url-uit-fitsociety>Header name: x-fitsociety-inbody-secretHeader value: <webhook-secret>

1. If headers do not work, use:

Webhook URL: <webhook-url-uit-fitsociety>?secret=<webhook-secret>

1. In FITsociety, click Link members automatically.

2. Check how many members have been linked and which members need review.

3. Click Retrieve all measurements.

4. Check a few members to confirm their measurements are visible in progress.

5. Take a test measurement on the InBody device.

6. Check whether the webhook automatically imports the new measurement.

7. Check whether PDFs are included. If not, ask InBody whether PDFs are available through the API.