Skip to main content
PATCH
JavaScript

Authorizations

Authorization
string
header
required

An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.

Headers

Api-Version-Date
string

Pins the request to a dated API version.

Example:

"2026-08-05-1"

Path Parameters

id
string
required

App ID (prefixed app_), the app's claimed route, or its proxy domain id.

Body

application/json
app_store_description
string

The detailed description shown on the app store's in-depth app view page.

app_type
enum<string>

The type of end-user the app is built for. Cannot be changed on an app whose type is already website.

Available options:
b2b_app,
b2c_app,
company_app,
component,
website
base_url
string

The base production URL where the app is hosted.

dashboard_path
string | null

The URL path for the account dashboard view.

description
string

A short description of the app shown in listings and search results.

discover_path
string | null

The URL path for the discover view.

experience_path
string | null

The URL path for the member-facing hub view, such as /experiences/[experienceId].

icon
object

The icon image for the app in PNG, JPEG, or GIF format, referencing an uploaded file: { id } for an existing attachment or { direct_upload_id } for a new direct upload.

name
string

The display name for the app, shown to users on the app store and product pages.

oauth_client_type
enum<string>

How the app authenticates at the OAuth token endpoint.

Available options:
public,
confidential
openapi_path
string | null

The URL path to the app's OpenAPI spec file (requires the ai_chat capability).

production_android_build_id
string | null

The app build (abld_ tag) to serve as the Android production build, or null to unassign it. Same rules as production_web_build_id.

production_ios_build_id
string | null

The app build (abld_ tag) to serve as the iOS production build, or null to unassign it. Same rules as production_web_build_id.

production_web_build_id
string | null

The app build (abld_ tag) to serve as the web production build, or null to unassign it. The build must belong to this app, target web, and be in the draft or approved status; a draft build is queued for approval and takes over once approved. Requires the developer:manage_builds scope.

redirect_uris
string[]

The whitelisted OAuth callback URLs users are redirected to after authorizing the app.

required_scopes
string[]

The OAuth scopes the app requests from users when they install it.

route
string

The subdomain route where the app's hosted web builds are served.

secrets
object

Secrets to add or overwrite on the app, as an object of string values. Keys not included are left untouched; pass null or an empty string as the value to delete a secret. Encrypted at rest and injected into the app's hosted server runtime.

skills_path
string | null

The URL path to the app's skills directory (requires the ai_chat capability).

status
enum<string>

Controls whether the app is published on Whop discovery or accessible only through its direct link. Publishing requires a name, icon, and description.

Available options:
live,
unlisted,
hidden

Response

app updated

account
object
required

The account that owns the app.

api_key
object | null
required

Legacy app API key used to authenticate requests on the app's behalf. null when no key exists or the caller lacks the developer:manage_api_key permission.

app_store_description
string | null
required

Detailed description shown on the app store's in-depth app page, or null when none has been set.

app_type
enum<string>
required

The type of end-user the app is built for.

Available options:
b2b_app,
b2c_app,
company_app,
component,
website
Example:

"b2b_app"

base_url
string | null
required

Production base URL where the app is hosted, or null if none is configured.

creator
object
required

The user who owns the publishing account.

dashboard_path
string | null
required

URL path for the account dashboard view, or null when not configured.

default_api_key
object | null
required

The app's default API key. null when the app has no default key or the caller lacks the developer:manage_api_key permission; secret_key is additionally null unless the caller could have created the key themselves.

description
string | null
required

Short description shown in listings and search results, or null if none has been set.

discover_path
string | null
required

URL path for the discover view, or null when not configured.

domain_id
string
required

Subdomain identifier for the app's proxied URL, forming https://{domain_id}.apps.whop.com.

experience_path
string | null
required

URL path for the member-facing hub view, or null when not configured.

hosted_url
string | null
required

Full URL where the app's hosted web build is served, or null if no route is claimed.

icon
object
required

The app's icon. Falls back to the default app icon when none is uploaded.

id
string
required

App ID, prefixed app_.

marketplace_status
enum<string> | null
required

Approval status of the app's product listing on the Whop app store, or null when the app has no associated product.

Available options:
not_available,
pending_review,
live_marketplace,
null
Example:

"not_available"

name
string
required

Display name shown on the app store and in experience navigation.

oauth_client_type
enum<string>
required

How the app authenticates at the OAuth token endpoint.

Available options:
public,
confidential
Example:

"public"

openapi_path
string | null
required

URL path to the app's OpenAPI spec file, or null when not configured.

origin
string | null
required

Full origin URL of the app's proxied domain, for example https://ab1c2d3e4f.apps.whop.com.

product_id
string | null
required

ID of the app's product listing on the Whop app store, or null when the app has no associated product.

production_android_build
object | null
required

The approved build currently served on Android, or null when none is deployed.

production_ios_build
object | null
required

The approved build currently served on iOS, or null when none is deployed.

production_web_build
object | null
required

The approved build currently served on web, or null when none is deployed.

redirect_uris
string[]
required

Whitelisted OAuth callback URLs users are redirected to after authorizing the app.

requested_permissions
object[]
required
required_scopes
enum<string>[]
required

Scopes the app asks a user to grant when they authorize it, shown on the consent screen.

Available options:
read_user
route
string | null
required

Claimed subdomain route where hosted web builds are served (myapp for myapp.whop.app), or null if no route is claimed.

secrets
object | null
required

The app's production secrets as an object of string values, injected into the hosted server runtime. null when the caller lacks the developer:update_app permission.

skills_path
string | null
required

URL path to the app's skills directory, or null when not configured.

status
enum<string>
required

Visibility on the Whop app store: live is publicly discoverable, unlisted is accessible only via direct link, hidden is not visible anywhere.

Available options:
live,
unlisted,
hidden
Example:

"live"

verified
boolean
required

Whether the app has been verified by Whop and is eligible for the featured apps section.