> ## Documentation Index > Fetch the complete documentation index at: https://docs.whop.com/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve API Key > Retrieves an API key with its effective permission grants. The full secret is never returned — rotate the key if it was lost. ## OpenAPI ````yaml /openapi/api-v1-native.json get /api_keys/{id} openapi: 3.1.0 info: description: >- The Whop REST API. Please see https://docs.whop.com/developer/api/getting-started for more details. termsOfService: https://whop.com/tos-developer-api/ title: Whop API version: 1.0.0 x-api-version-date: '2026-07-20' servers: - description: Production Whop API url: https://api.whop.com/api/v1 - description: Sandbox Whop API url: https://sandbox-api.whop.com/api/v1 security: [] tags: - description: > An Account represents a person or business on Whop that can have its own profile, wallet, and account-scoped settings. Use accounts for customers, creators, merchants, sellers, or connected businesses your integration supports. Use the Accounts API to create accounts, list accounts visible to your credentials, retrieve or update an account, and retrieve the account associated with the current API key. name: Accounts x-whop-summary: 'A business on Whop: profile, wallet, capabilities, settings.' - description: > A User represents a person on Whop. Users have a public profile and can buy products, join accounts, and access experiences. Use the Users API to search for users, retrieve or update profiles, and check whether a user has access to an account, product, or experience. name: Users x-whop-summary: 'A person on Whop: profile and connected identities.' - description: > A Team Member is a member of an account's team: the link between a user and an account, carrying the role that controls what they can do. Roles are either system roles (like `admin` or `moderator`) or `custom` roles managed from the dashboard. Use the Team Members API to list an account's team, add a user to the team with a system role, change a member's role, and remove members. Adding a user who has not yet accepted sends an invitation instead. name: Team Members x-whop-summary: An account's team members and the roles that scope their access. - name: Webhooks x-whop-summary: Event notifications pushed to your server as things happen. - description: > Stats represent aggregated activity for an account over time. They help you understand revenue, transactions, disputes, members, referrals, and advertising performance across reporting periods like days, weeks, or months. Use the Stats API to list available metrics and their filterable properties, then retrieve time-series values for a date range. name: Stats x-whop-summary: Aggregated financial, audience, and traffic reporting. - description: > A Ledger Activity row is a single financial event on an account's ledger — a payment, withdrawal, refund, transfer, on-chain deposit, swap, or card transaction. Each row is derived from the underlying ledger lines and carries a typed `resource` and `source` so you can present and link the event without extra lookups. Use Ledger Activity to build a statement or transaction feed for an account or user. Reconcile against your own records with `amount` (signed, in the currency's smallest precision units) and `posted_at`, and use `available_at` to know when inflows became withdrawable. name: Ledgers x-whop-summary: The activity feed behind an account or user's balance. - description: > Payouts represent money sent from an account or user balance to an external destination, such as a bank account, wallet, or other saved payout method. Use the Payouts API to create payouts from stablecoin accounts, list payout history for accounts or users, monitor payout statuses, and show expected arrival details for funds leaving Whop. name: Payouts x-whop-summary: Send money from a balance to a bank or wallet. - description: > Cards represent Whop-issued virtual payment cards that spend from an account or user balance. Cards can be assigned to cardholders and configured with spending limits for controlled spending. Use the Cards API to issue cards, list cards for an account or user, and retrieve active card details such as the card number and CVC. name: Cards x-whop-summary: Issue cards that spend from a balance. - description: > Transfers move value between identities on Whop. They are used for account-to-account money movement, user payouts inside Whop, crypto transfers, and claim links depending on the destination type. Use the Transfers API to create a transfer, list previous transfers, and retrieve a transfer by ID when reconciling money movement between accounts or users. name: Transfers x-whop-summary: Move funds between Whop accounts and users. - description: > Deposits describe ways to add funds to an account balance, including hosted deposit pages, bank deposit instructions, and supported crypto wallet addresses. Use the Deposits API to create deposit instructions for an account. name: Deposits x-whop-summary: Add funds to a balance. - description: > Swaps convert value between supported tokens, chains, or wallet destinations for an account. A swap quote describes the expected output, fees, and approval requirements before you create the swap. Use the Swaps API to quote a conversion, create the swap, list recent swaps, and retrieve status until the transaction completes. name: Swaps x-whop-summary: Convert a balance between currencies. - description: > A Verification represents a legal identity for a person or business. Accounts and users complete verification when Whop needs to confirm who they are before enabling payouts or compliance-sensitive workflows. Use the Verifications API to start or resume a hosted verification session, check review status, and submit requested details or documents. If `requested_information` contains items, submit answers with [Update Verification](/api-reference/beta/verifications/update-verification). name: Verifications x-whop-summary: Legal identity required before payouts and card issuing. - description: > A Product is a digital good or service sold on Whop. Products may contain plans for pricing and/or experiences for content delivery. Use the Products API to create products, list products visible to your credentials, retrieve product details, update product metadata or merchandising fields, and delete products that should no longer be sold. name: Products x-whop-summary: The things you sell. Each owns plans and a store page. - description: > A Plan defines how customers buy a product. It controls pricing, billing cadence, availability, tax behavior, checkout fields, and purchase visibility. Use the Plans API to create plans for products, list existing plans, retrieve or update plan configuration, calculate tax for checkout, and delete plans that should no longer be offered. name: Plans x-whop-summary: 'Pricing for a product: one-time, recurring, trials, stock.' - description: > A Checkout Configuration is a reusable checkout link owned by an account. In `payment` mode it sells a specific plan; in `setup` mode it collects and saves payment details without charging. Each configuration can also override which payment methods are accepted and how 3D Secure is enforced for that checkout. Use the Checkout Configurations API to create checkout links for an existing or inline plan, list configurations for an account, retrieve the configuration behind a checkout URL, and delete links that should no longer be used. name: Checkout Configurations x-whop-summary: Turn a plan into a shareable, prefilled checkout link. - description: > The Partners API covers your Whop partner activity: the users you referred onto Whop, the businesses you referred and the earnings generated from their processing volume, and the partner leaderboard. Use it to enroll as a Whop partner, list the users you referred, list your referred businesses and review their earnings, and see the partner leaderboard. name: Partners x-whop-summary: >- The users and businesses you referred to Whop, and what you earn from them. - description: > A Bounty is a paid task posted by an account or user. The reward is held in escrow when the bounty publishes, workers submit proof of completed work, and each accepted submission is paid out until every winner slot fills. Use the Bounties API to create and publish a bounty, list an account's bounties for reporting or dashboards, list the bounties a user can work or has participated in, and retrieve a single bounty by ID. name: Bounties x-whop-summary: Paid tasks with reviewed submissions and escrowed rewards. - description: > A Bounty Submission is one worker's attempt on a bounty. It starts as an in-progress attempt, enters the review queue when proof is submitted, and ends approved (paid from the bounty's escrowed pool) or denied. Use the Bounty Submissions API to submit proof of completed work to a bounty, list the submissions you authored, and review the submissions on your bounties — across every bounty or narrowed to one. name: Bounty Submissions x-whop-summary: Work submitted to a bounty, from attempt to payout. - description: > A Person represents a visitor or customer of an account, assembled from [pixel events](/api-reference/beta/events/event) and purchase activity — ad clicks, storefront visits, and checkouts. Use the People API to list the people of an account and retrieve a single person. name: People x-whop-summary: Visitors and customers of an account, aggregated from pixel events. - description: > An Event records conversion or engagement activity for an account, such as page views, purchases, or leads. Each event ties the action to the [person](/api-reference/beta/people/person) who took it, so activity can be attributed to the ads and links that drove it. Use the Events API to send new tracking events, list recent identity-linked events for an account, and inspect the events recorded for a person. name: Events x-whop-summary: Conversion and engagement events tracked for attribution. - description: > An Ad is the individual creative unit delivered by an [ad group](/api-reference/beta/ad-groups/ad-group). It holds the copy, creative assets, and destination URL for one ad. Use the Ads API to list ads for an account, create ads inside ad groups, retrieve or update creative details, delete ads that should stop running, and pause or resume delivery. name: Ads x-whop-summary: 'The creative: copy, assets, and destination URL.' - description: > An Ad Campaign is the top-level container for paid ads on an ad network. It sets the platform, objective, and budget strategy shared by its [ad groups](/api-reference/beta/ad-groups/ad-group) and ads. Use the Ad Campaigns API to create campaigns, list campaigns for an account, retrieve or update campaign settings, and pause or resume campaign delivery. name: Ad Campaigns x-whop-summary: Platform, objective, and budget for a set of ads. - description: > An Ad Group sits inside an [ad campaign](/api-reference/beta/ad-campaigns/ad-campaign) and controls delivery for [ads](/api-reference/beta/ads/ad). It sets the audience, placements, schedule, budget, and optimization goal for its ads. Use the Ad Groups API to create ad groups in campaigns, list or retrieve targeting and delivery settings, update budgets or targeting, delete groups that should stop running, and pause or resume delivery. It can also search the ad platform's targeting taxonomy for options to target and estimate how many people a draft targeting spec can reach. name: Ad Groups x-whop-summary: Audience, placements, and schedule within a campaign. - description: > An Audience represents a customer list uploaded to Whop for ad targeting. Audiences belong to an account and sync to supported ad platforms as custom audiences. Use the Audiences API to create audiences from CSV uploads, monitor processing status, and list or delete audiences for an account. Created audiences are usable for targeting after processing reaches `ready` or `partial`. name: Audiences x-whop-summary: Reusable targeting lists for ad groups. - description: > A Media Asset is an AI-generated image or video created from a prompt and billed from an account balance. When generation finishes, the asset includes a file that can be attached anywhere Whop accepts files. Use the Media API to start a generation job and retrieve the asset while it processes or after it is ready. name: Media x-whop-summary: >- AI-generated assets, billed from a balance, attachable wherever files are accepted. - description: > A Social Account represents an external profile connected to a Whop account or user, such as a Facebook page or Instagram account. Connecting a social account lets Whop run [ads](/api-reference/beta/ads/ad) under that profile's identity and promote its existing posts. Use the Social Accounts API to list connected accounts, create a Whop-managed Facebook page, start an OAuth connection, disconnect a social account, and list a connected profile's posts or a Facebook page's lead forms. name: Social Accounts x-whop-summary: Connected Facebook and Instagram accounts that run ads. - description: > An App is software you build on Whop. It can be a hosted web app served at `.whop.app` or an API integration installed as an experience, and it belongs to the account that owns its credentials, settings, builds, and runtime logs. Use the Apps API to manage app configuration and, for hosted apps, read server runtime logs for console output, uncaught exceptions, and failed requests. Logs are retained for 7 days and can be filtered by build, level, time window, and message text. name: Apps x-whop-summary: 'Apps you build on Whop: metadata, hosted builds, runtime logs.' - description: > An App Build is a versioned artifact uploaded for an app — a hosted web archive, or an iOS/Android bundle. Builds start as drafts, go through review, and one approved build per platform is served to users as the production build. Use the App Builds API to upload a build for an app, list an app's builds with platform and status filters, retrieve a build, and promote a draft or approved build to production. name: App Builds x-whop-summary: Versioned build artifacts deployed to an app's platforms. - description: > An API Key is a programmatic credential owned by an account or app. Each key carries its own permissions policy — explicit permission statements or an inherited system role — and can be restricted with an expiration date and an IP allowlist. Use the API Keys API to list a company or app's keys, create a key (the full secret is returned once, on creation), inspect a key's effective grants, update its name or restrictions, rotate its secret, and revoke it. These endpoints require a user session — they cannot be called with an API key. name: API Keys x-whop-summary: Programmatic credentials for an account or app. paths: /api_keys/{id}: parameters: - $ref: '#/components/parameters/ApiVersionDate' - description: API key ID, prefixed `apik_`. in: path name: id required: true schema: type: string get: tags: - API Keys summary: Retrieve API Key description: >- Retrieves an API key with its effective permission grants. The full secret is never returned — rotate the key if it was lost. operationId: retrieveApiKey responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApiKey' description: api key retrieved with grants but never the secret '401': $ref: '#/components/responses/Unauthorized' description: missing or invalid authentication '403': $ref: '#/components/responses/Forbidden' description: credential lacks the required api-key management scope '404': $ref: '#/components/responses/NotFound' description: no api key with that ID exists security: - bearerAuth: - developer:manage_api_key x-codeSamples: - lang: JavaScript source: |- import Whop from '@whop/sdk'; const client = new Whop({ apiKey: process.env['WHOP_API_KEY'], // This is the default and can be omitted }); const apiKey = await client.apiKeys.retrieve('id'); console.log(apiKey.id); components: parameters: ApiVersionDate: description: Pins the request to a dated API version. in: header name: Api-Version-Date required: false schema: example: '2026-07-20' type: string schemas: ApiKey: properties: created_at: description: When the API key was created, as an ISO 8601 timestamp. type: string expires_at: description: >- When the API key stops working, as an ISO 8601 timestamp. `null` means it never expires. type: - string - 'null' grants: items: $ref: '#/components/schemas/ApiKeyGrant' description: >- The key's effective permissions, grouped by resource. Present on retrieve, create, update, and rotate responses; omitted on list. type: array id: description: API key ID, prefixed `apik_`. type: string ip_allowlist: items: description: >- IPv4/IPv6 CIDR ranges allowed to use this key. `null` or empty means requests are accepted from any IP. type: string type: - array - 'null' is_default_for_resource: description: >- Whether this is the resource's default API key. Default keys cannot be updated or deleted, only rotated. type: boolean name: description: >- Human-readable name identifying the API key, or `null` when none was set. type: - string - 'null' obfuscated_secret_key: description: >- Masked version of the secret key, so the key can be recognized without revealing the full secret. type: string secret_key: description: >- The full secret used to authenticate requests. Returned only once, on create and rotate responses — store it immediately. type: string system_role: description: >- System role the key inherits its permissions from, or `null` when it uses an explicit permissions policy. Only account API keys can use a system role. enum: - owner - admin - moderator - sales_manager - advertiser - null example: owner type: - string - 'null' updated_at: description: When the API key was last updated, as an ISO 8601 timestamp. type: string required: - id - name - obfuscated_secret_key - is_default_for_resource - system_role - expires_at - ip_allowlist - created_at - updated_at type: object ApiKeyGrant: properties: actions: items: $ref: '#/components/schemas/ApiKeyGrantAction' description: >- The actions the grant covers on the resource, each marked granted or not. type: array resource_id: description: ID of the resource the actions apply to. type: string resource_type: description: >- The type of resource the actions apply to, such as `account`, `product`, or `app`. type: string required: - resource_id - resource_type - actions type: object V1ErrorResponse: properties: error: properties: message: description: Human-readable error message. type: string type: description: Machine-readable error code. type: string required: - type - message type: object required: - error type: object ApiKeyGrantAction: properties: action: description: >- The permission action's identifier, for example `company:basic:read`. type: string granted: description: Whether the key holds the action on the grant's resource. type: boolean required: - action - granted type: object responses: Unauthorized: content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' description: Unauthorized Forbidden: content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' description: Forbidden NotFound: content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' description: Resource not found securitySchemes: bearerAuth: bearerFormat: auth-scheme description: >- A company API key, company scoped JWT, app API key, or user OAuth token. You must prepend your key/token with the word 'Bearer', which will look like `Bearer ***************************` scheme: bearer type: http ````