Update App Permissions
Replaces the set of permissions the app requests from users when they install it. Requires a user session: the developer:update_app_authorization scope cannot be delegated to API keys.
Authorizations
An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.
Headers
Pins the request to a dated API version.
"2026-08-05-1"
Path Parameters
App ID, prefixed app_.
Body
The full set of permissions the app requests on install; permissions not listed are removed.
Response
requested permissions updated
The account that owns the app.
Legacy app API key used to authenticate requests on the app's behalf. null when no key exists or the caller lacks the developer:manage_api_key permission.
Detailed description shown on the app store's in-depth app page, or null when none has been set.
The type of end-user the app is built for.
b2b_app, b2c_app, company_app, component, website "b2b_app"
Production base URL where the app is hosted, or null if none is configured.
The user who owns the publishing account.
URL path for the account dashboard view, or null when not configured.
The app's default API key. null when the app has no default key or the caller lacks the developer:manage_api_key permission; secret_key is additionally null unless the caller could have created the key themselves.
Short description shown in listings and search results, or null if none has been set.
URL path for the discover view, or null when not configured.
Subdomain identifier for the app's proxied URL, forming https://{domain_id}.apps.whop.com.
URL path for the member-facing hub view, or null when not configured.
Full URL where the app's hosted web build is served, or null if no route is claimed.
The app's icon. Falls back to the default app icon when none is uploaded.
App ID, prefixed app_.
Approval status of the app's product listing on the Whop app store, or null when the app has no associated product.
not_available, pending_review, live_marketplace, null "not_available"
Display name shown on the app store and in experience navigation.
How the app authenticates at the OAuth token endpoint.
public, confidential "public"
URL path to the app's OpenAPI spec file, or null when not configured.
Full origin URL of the app's proxied domain, for example https://ab1c2d3e4f.apps.whop.com.
ID of the app's product listing on the Whop app store, or null when the app has no associated product.
The approved build currently served on Android, or null when none is deployed.
The approved build currently served on iOS, or null when none is deployed.
The approved build currently served on web, or null when none is deployed.
Whitelisted OAuth callback URLs users are redirected to after authorizing the app.
Scopes the app asks a user to grant when they authorize it, shown on the consent screen.
read_user Claimed subdomain route where hosted web builds are served (myapp for myapp.whop.app), or null if no route is claimed.
The app's production secrets as an object of string values, injected into the hosted server runtime. null when the caller lacks the developer:update_app permission.
URL path to the app's skills directory, or null when not configured.
Visibility on the Whop app store: live is publicly discoverable, unlisted is accessible only via direct link, hidden is not visible anywhere.
live, unlisted, hidden "live"
Whether the app has been verified by Whop and is eligible for the featured apps section.

