Update App
Updates the settings, metadata, or status of an app. Fields that are omitted keep their current value.
Authorizations
A company API key, company scoped JWT, app API key, or user OAuth token. You must prepend your key/token with the word 'Bearer', which will look like Bearer ***************************
Headers
Pins the request to a dated API version.
"2026-07-20"
Path Parameters
App ID (prefixed app_), the app's claimed route, or its proxy domain id.
Body
The detailed description shown on the app store's in-depth app view page.
The type of end-user the app is built for.
b2b_app, b2c_app, company_app, component The base production URL where the app is hosted.
The URL path for the company dashboard view.
A short description of the app shown in listings and search results.
The URL path for the discover view.
The URL path for the member-facing hub view, such as /experiences/[experienceId].
The icon image for the app in PNG, JPEG, or GIF format, referencing an uploaded file: { id } for an existing attachment or { direct_upload_id } for a new direct upload.
The display name for the app, shown to users on the app store and product pages.
How the app authenticates at the OAuth token endpoint.
public, confidential The URL path to the app's OpenAPI spec file (requires the ai_chat capability).
The app build (abld_ tag) to serve as the Android production build, or null to unassign it. Same rules as production_web_build_id.
The app build (abld_ tag) to serve as the iOS production build, or null to unassign it. Same rules as production_web_build_id.
The app build (abld_ tag) to serve as the web production build, or null to unassign it. The build must belong to this app, target web, and be in the draft or approved status; a draft build is queued for approval and takes over once approved. Requires the developer:manage_builds scope.
The whitelisted OAuth callback URLs users are redirected to after authorizing the app.
The OAuth scopes the app requests from users when they install it.
The subdomain route where the app's hosted web builds are served.
Secrets to add or overwrite on the app, as an object of string values. Keys not included are left untouched; pass null or an empty string as the value to delete a secret. Encrypted at rest and injected into the app's hosted server runtime.
The URL path to the app's skills directory (requires the ai_chat capability).
Controls the app's visibility. live publishes on Whop discovery (requires name, icon, and description); unlisted hides it from discovery while keeping direct-link access.
live, unlisted, hidden Response
app updated
An app is an integration built on Whop. Apps can serve consumers as experiences within products, or serve companies as business tools.
The API key used to authenticate requests on behalf of this app. Null if no API key has been generated. Requires the 'developer:manage_api_key' permission.
The target audience classification for this app (e.g., 'b2b_app', 'b2c_app', 'company_app', 'component').
b2b_app, b2c_app, company_app, component The production base URL where the app is hosted. Null if no base URL is configured.
"https://myapp.example.com"
The company that owns and publishes this app.
The user who created and owns the company that published this app.
The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
The app's default API key, used to authenticate requests on behalf of this app. Null if the app has no default key. Requires the 'developer:manage_api_key' permission.
A written description of what this app does, displayed on the app store listing page. Null if no description has been set.
"A comprehensive analytics dashboard for tracking revenue, members, and growth metrics."
The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
The unique subdomain identifier for this app's proxied URL on the Whop platform. Forms the URL pattern https://{domain_id}.apps.whop.com.
"ab1c2d3e4f5g6h7i8j9k"
The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
The full canonical URL where this app's hosted web build is served. Null if the app has not claimed a route.
"https://myapp.whop.app"
The icon image for this app, displayed on the app store, product pages, checkout, and as the default icon for experiences using this app.
The unique identifier for the app.
"app_xxxxxxxxxxxxxx"
The approval status of this app's product listing on the Whop app store. Null if the app has no associated product.
not_available, pending_review, live_marketplace The display name of this app shown on the app store and in experience navigation. Maximum 30 characters.
"Courses"
How this app authenticates when exchanging OAuth authorization and refresh grants.
public, confidential The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
The full origin URL for this app's proxied domain (e.g., 'https://myapp.apps.whop.com'). Null if no proxy domain is configured.
Represents a unique identifier that is Base64 obfuscated. It is often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as "VXNlci0xMA==") or integer (such as 4) input value will be accepted as an ID.
The approved app build currently served to users on web. Null if no production build is deployed for web.
The whitelisted OAuth callback URLs that users are redirected to after authorizing the app.
Represents textual data as UTF-8 character sequences. This type is most often used by GraphQL to represent free-form human-readable text.
The list of permissions this app requests when installed, including both required and optional permissions with justifications.
The unique subdomain route where this app's hosted web builds are served, such as 'myapp' for myapp.whop.app. Null if the app has not claimed a route.
"myapp"
The app's secrets as an object of string values. Encrypted at rest and injected into the app's hosted server runtime as environment bindings. Requires the 'developer:update_app' permission.
The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured.
"/experiences/[experienceId]"
Aggregate usage statistics for this app, including daily, weekly, and monthly active user counts.
The current visibility status of this app on the Whop app store. 'live' means publicly discoverable, 'unlisted' means accessible only via direct link, and 'hidden' means not visible anywhere.
live, unlisted, hidden Whether this app has been verified by Whop. Verified apps are endorsed by Whop and displayed in the featured apps section of the app store.

