Files for tutorial at http://willhalling.com/blog/connect-to-strava-api-javascript-php

strava.es6

// declare our Strava Class
class Strava {
    // define our constructor method
    // pass in the Running Routes object
    constructor(application) {
      this.CLIENT_ID = application.CLIENT_ID;
      this.AUTHORIZATION_ENDPOINT = application.AUTHORIZATION_ENDPOINT;
      this.ACCESS_TOKEN = application.ACCESS_TOKEN;
      this.ACCESS_TOKEN_AUTHORIZED = null;
    }
    // called on load
    // check if user has been here before (local storage)
    // else grab the access token from URL parameter
    init(){
      this.login();
      var stravaUser = localStorage.getItem('RR_Strava');
      this.ACCESS_TOKEN_AUTHORIZED = this.extractToken(window.location.href);
      // if user data exists in local storage
      if (stravaUser) {
        this.loggedIn(stravaUser);
      // else if url parameter/user clicked on login btn
      } else if (this.ACCESS_TOKEN_AUTHORIZED) {
        this.accessAPI();
      }
      // if user has logged out
      if(window.location.href.indexOf("logged-out") > -1) {
        this.loggedOut();
      }

    }
    // build and show the strava login button
    login(){
      $("a.strava-login").show();  
      $(".navbar-signin-loggedIn").hide();
      var authUrl = this.AUTHORIZATION_ENDPOINT + 
        "?client_id="    + this.CLIENT_ID +
        "&response_type=code" +
        "&redirect_uri=http://www.runningroutes.co.uk/demo/strava_token_request.php"
        "&scope=write"
        "&approval_prompt=force"
      $("a.strava-login").attr("href", authUrl);      
    }
    // display the username & hide the login button
    loggedIn(user) {
      var userObject = user;
      var userData = JSON.parse(userObject);
      $("a.strava-login").hide();
      $(".navbar-signin-loggedIn").show(); 
      $(".user_id").html(userData.username);  
    }
    // remove local storage
    loggedOut() {
      localStorage.removeItem("RR_Strava");
    }
    // extract the access token from URL parameter
    extractToken(url) {
      var match = url.match(/access_token=([\w-]+)/);
      return !!match && match[1];
    }
    // call the strava API with our newly created Access Token
    // add user response data to local storage
    accessAPI() {
      var that = this;
      $.ajax({
          url: 'https://www.strava.com/api/v3/athlete?per_page=1&access_token='
          +this.ACCESS_TOKEN_AUTHORIZED+'',
          dataType: 'jsonp',
          success: function(response){
            localStorage.setItem('RR_Strava', JSON.stringify(response));
            var stravaUser = localStorage.getItem('RR_Strava');
            that.loggedIn(stravaUser);
          }
      });
    }
}

// our application object to be passed as a parameter to the constructor 
var runningroutes = {
  // replace with your Client ID
  CLIENT_ID: XXXX,
  AUTHORIZATION_ENDPOINT: 'https://www.strava.com/oauth/authorize',
  // replace with your Access Token
  ACCESS_TOKEN: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
  ACCESS_TOKEN_AUTHORIZED: null
}

// instantiate a new application & call init method
var StravaView = new Strava(runningroutes);
StravaView.init();

strava_token_request.php

<?php
function tokenRequest($clientId, $clientSecret, $code) {
	$url =  'https://www.strava.com/oauth/token?';
	$clientId =  'XXXX';
	$clientSecret =  'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';
	$oauthFields = array(
	    'client_id' => $clientId,
	    'client_secret' => $clientSecret,
	    'code' => $code);
	$parameters = http_build_query($oauthFields);
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $url.$parameters);
	curl_setopt($ch, CURLOPT_POST, count($oauthFields));
	curl_setopt($ch, CURLOPT_POSTFIELDS, $parameters);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)');
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 1);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, TRUE);
	$urlResponse = curl_exec($ch);
	curl_close($ch);
	return (json_decode($urlResponse));
}

if (isset($_GET['code'])){
   $code = $_GET['code'];
   $token = tokenRequest($clientId, $clientSecret, $code);
   $access_token = $token->access_token;
   // redirect back to the app with the access token
   header('Location: http://localhost:9000?access_token='.$access_token.'');
} else {
   // User denied access request
   header('Location: http://localhost:9000?access_token=error');
}
?>