open_oura: a cloud-free Oura Ring client built on its reverse-engineered BLE protocol

Requirements & limits

• Reviewed at the 2026-10-07 main head; there are no releases or tags, and the workspace version is 0.1.0. The README reports live pairing, authentication and event sync on a Ring 3 Horizon and a Ring 5, and says the client is designed for Ring 3/4/5, which share one GATT layout, packet framing and auth flow. Several event layouts are marked inferred or partly unresolved, and the algorithm status table lists the sleep, readiness and activity scores as only partly recovered. The iOS app and web dashboard built on these crates live in the separate open_health repository.
• Requires the user's own ring and a host Bluetooth adapter. Auth-gated reads need the ring's 16-byte app-auth key in a key file: the pair command installs a new key on a factory-reset ring, while an app-onboarded ring's key sits in the official app's local database, and the bundled helper for exporting it needs a rooted Android phone. Sleep staging and some scores depend on Oura's proprietary on-device models, which the README says are not included and must be supplied by the user; factory-reset and other state-changing commands sit behind explicit flags.
• Builds with Cargo as a Rust 2021 workspace. The oura-link crate uses btleplug for BLE by default and can be built without it so that an iOS host supplies its own CoreBluetooth transport; on macOS the terminal needs Bluetooth permission. A separate Python research bench in tools/ uses bleak and pycryptodome.
• cargo test runs 88 Rust unit tests at review, covering captured-packet decoding, an AES auth known-answer vector, mock-transport authentication and sync and the ported metric functions; no CI workflow is committed. Physiological figures in the documentation, such as overnight heart rate, RMSSD and SpO2 ratios, come from the author's own rings, and this review ran neither the tests nor the client.
• MIT (LICENSE and Cargo metadata). Oura's apps, native libraries, models, firmware, decompiled output, captures and keys are kept out of the repository; its firmware-update, model-decryption and app-patching notes are deliberately not linked or restated here. A CLAUDE.md guide for coding agents is committed, and the reviewed sources establish no REA connection.

About this entry

Type

Case study

Category

Independent reconstruction cases

Relationship

Independent reconstruction project

Targets

App · Protocol

Sources reviewed 2026-10-20

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry ↗Suggest a translation fix ↗

Primary sources

1. README.md GitHub · Th0rgal/open_oura · Revision e57c43c
2. crates/README.md GitHub · Th0rgal/open_oura · Revision e57c43c
3. docs/architecture.md GitHub · Th0rgal/open_oura · Revision e57c43c
4. docs/horizon-ring3-protocol-cheatsheet.md GitHub · Th0rgal/open_oura · Revision e57c43c
5. docs/native-decoder.md GitHub · Th0rgal/open_oura · Revision e57c43c
6. docs/algorithms/README.md GitHub · Th0rgal/open_oura · Revision e57c43c
7. docs/data-recovery-map.md GitHub · Th0rgal/open_oura · Revision e57c43c
8. docs/security-observations.md GitHub · Th0rgal/open_oura · Revision e57c43c
9. crates/oura-protocol/src/events.rs GitHub · Th0rgal/open_oura · Revision e57c43c
10. crates/oura-protocol/src/auth.rs GitHub · Th0rgal/open_oura · Revision e57c43c
11. crates/oura-link/Cargo.toml GitHub · Th0rgal/open_oura · Revision e57c43c
12. Cargo.toml GitHub · Th0rgal/open_oura · Revision e57c43c
13. CLAUDE.md GitHub · Th0rgal/open_oura · Revision e57c43c
14. LICENSE GitHub · Th0rgal/open_oura · Revision e57c43c