Create Confirmation Token

curl --request POST \
  --url https://api.whop.com/api/v1/confirmation_tokens \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "billing_details": {
    "address": {
      "city": "Austin",
      "country": "US",
      "line1": "123 Main St",
      "postal_code": "78701"
    },
    "email": "buyer@example.com",
    "name": "Buyer Name"
  },
  "payment_method": {
    "card": {
      "brand": "visa",
      "last4": "4242",
      "token_intent": "bt_ti_123"
    },
    "category": "card",
    "type": "card"
  },
  "setup_future_usage": "off_session"
}
'

import requests

url = "https://api.whop.com/api/v1/confirmation_tokens"

payload = {
    "account_id": "biz_xxxxxxxxxxxxxx",
    "billing_details": {
        "address": {
            "city": "Austin",
            "country": "US",
            "line1": "123 Main St",
            "postal_code": "78701"
        },
        "email": "buyer@example.com",
        "name": "Buyer Name"
    },
    "payment_method": {
        "card": {
            "brand": "visa",
            "last4": "4242",
            "token_intent": "bt_ti_123"
        },
        "category": "card",
        "type": "card"
    },
    "setup_future_usage": "off_session"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    account_id: 'biz_xxxxxxxxxxxxxx',
    billing_details: {
      address: {city: 'Austin', country: 'US', line1: '123 Main St', postal_code: '78701'},
      email: 'buyer@example.com',
      name: 'Buyer Name'
    },
    payment_method: {
      card: {brand: 'visa', last4: '4242', token_intent: 'bt_ti_123'},
      category: 'card',
      type: 'card'
    },
    setup_future_usage: 'off_session'
  })
};

fetch('https://api.whop.com/api/v1/confirmation_tokens', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.whop.com/api/v1/confirmation_tokens",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'account_id' => 'biz_xxxxxxxxxxxxxx',
    'billing_details' => [
        'address' => [
                'city' => 'Austin',
                'country' => 'US',
                'line1' => '123 Main St',
                'postal_code' => '78701'
        ],
        'email' => 'buyer@example.com',
        'name' => 'Buyer Name'
    ],
    'payment_method' => [
        'card' => [
                'brand' => 'visa',
                'last4' => '4242',
                'token_intent' => 'bt_ti_123'
        ],
        'category' => 'card',
        'type' => 'card'
    ],
    'setup_future_usage' => 'off_session'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.whop.com/api/v1/confirmation_tokens"

	payload := strings.NewReader("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"billing_details\": {\n    \"address\": {\n      \"city\": \"Austin\",\n      \"country\": \"US\",\n      \"line1\": \"123 Main St\",\n      \"postal_code\": \"78701\"\n    },\n    \"email\": \"buyer@example.com\",\n    \"name\": \"Buyer Name\"\n  },\n  \"payment_method\": {\n    \"card\": {\n      \"brand\": \"visa\",\n      \"last4\": \"4242\",\n      \"token_intent\": \"bt_ti_123\"\n    },\n    \"category\": \"card\",\n    \"type\": \"card\"\n  },\n  \"setup_future_usage\": \"off_session\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.whop.com/api/v1/confirmation_tokens")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"billing_details\": {\n    \"address\": {\n      \"city\": \"Austin\",\n      \"country\": \"US\",\n      \"line1\": \"123 Main St\",\n      \"postal_code\": \"78701\"\n    },\n    \"email\": \"buyer@example.com\",\n    \"name\": \"Buyer Name\"\n  },\n  \"payment_method\": {\n    \"card\": {\n      \"brand\": \"visa\",\n      \"last4\": \"4242\",\n      \"token_intent\": \"bt_ti_123\"\n    },\n    \"category\": \"card\",\n    \"type\": \"card\"\n  },\n  \"setup_future_usage\": \"off_session\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.whop.com/api/v1/confirmation_tokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"billing_details\": {\n    \"address\": {\n      \"city\": \"Austin\",\n      \"country\": \"US\",\n      \"line1\": \"123 Main St\",\n      \"postal_code\": \"78701\"\n    },\n    \"email\": \"buyer@example.com\",\n    \"name\": \"Buyer Name\"\n  },\n  \"payment_method\": {\n    \"card\": {\n      \"brand\": \"visa\",\n      \"last4\": \"4242\",\n      \"token_intent\": \"bt_ti_123\"\n    },\n    \"category\": \"card\",\n    \"type\": \"card\"\n  },\n  \"setup_future_usage\": \"off_session\"\n}"

response = http.request(request)
puts response.read_body

{
  "billing_details": {
    "country": "AR",
    "email": "marcus@shinetime.example",
    "name": "Buyer Name",
    "postal_code": "C1043"
  },
  "created_at": "2026-01-01T12:00:00.000Z",
  "expires_at": "2026-01-01T12:00:00.000Z",
  "id": "ctok_xxxxxxxxxxxxxx",
  "object": "confirmation_token",
  "payment_method_preview": {
    "category": "saved",
    "display_name": "Visa •••• 4242",
    "id": "payt_xxxxxxxxxxxxxx",
    "type": "card",
    "bank_debit": {
      "brand": "visa",
      "last4": "4242"
    },
    "card": {
      "brand": "visa",
      "last4": "4242"
    },
    "saved": {
      "brand": "visa",
      "last4": "4242"
    },
    "wallet": {
      "brand": "visa",
      "last4": "4242"
    }
  },
  "setup_future_usage": "off_session",
  "status": "pending"
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

POST

confirmation_tokens

Create Confirmation Token

curl --request POST \
  --url https://api.whop.com/api/v1/confirmation_tokens \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "billing_details": {
    "address": {
      "city": "Austin",
      "country": "US",
      "line1": "123 Main St",
      "postal_code": "78701"
    },
    "email": "buyer@example.com",
    "name": "Buyer Name"
  },
  "payment_method": {
    "card": {
      "brand": "visa",
      "last4": "4242",
      "token_intent": "bt_ti_123"
    },
    "category": "card",
    "type": "card"
  },
  "setup_future_usage": "off_session"
}
'

import requests

url = "https://api.whop.com/api/v1/confirmation_tokens"

payload = {
    "account_id": "biz_xxxxxxxxxxxxxx",
    "billing_details": {
        "address": {
            "city": "Austin",
            "country": "US",
            "line1": "123 Main St",
            "postal_code": "78701"
        },
        "email": "buyer@example.com",
        "name": "Buyer Name"
    },
    "payment_method": {
        "card": {
            "brand": "visa",
            "last4": "4242",
            "token_intent": "bt_ti_123"
        },
        "category": "card",
        "type": "card"
    },
    "setup_future_usage": "off_session"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    account_id: 'biz_xxxxxxxxxxxxxx',
    billing_details: {
      address: {city: 'Austin', country: 'US', line1: '123 Main St', postal_code: '78701'},
      email: 'buyer@example.com',
      name: 'Buyer Name'
    },
    payment_method: {
      card: {brand: 'visa', last4: '4242', token_intent: 'bt_ti_123'},
      category: 'card',
      type: 'card'
    },
    setup_future_usage: 'off_session'
  })
};

fetch('https://api.whop.com/api/v1/confirmation_tokens', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.whop.com/api/v1/confirmation_tokens",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'account_id' => 'biz_xxxxxxxxxxxxxx',
    'billing_details' => [
        'address' => [
                'city' => 'Austin',
                'country' => 'US',
                'line1' => '123 Main St',
                'postal_code' => '78701'
        ],
        'email' => 'buyer@example.com',
        'name' => 'Buyer Name'
    ],
    'payment_method' => [
        'card' => [
                'brand' => 'visa',
                'last4' => '4242',
                'token_intent' => 'bt_ti_123'
        ],
        'category' => 'card',
        'type' => 'card'
    ],
    'setup_future_usage' => 'off_session'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.whop.com/api/v1/confirmation_tokens"

	payload := strings.NewReader("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"billing_details\": {\n    \"address\": {\n      \"city\": \"Austin\",\n      \"country\": \"US\",\n      \"line1\": \"123 Main St\",\n      \"postal_code\": \"78701\"\n    },\n    \"email\": \"buyer@example.com\",\n    \"name\": \"Buyer Name\"\n  },\n  \"payment_method\": {\n    \"card\": {\n      \"brand\": \"visa\",\n      \"last4\": \"4242\",\n      \"token_intent\": \"bt_ti_123\"\n    },\n    \"category\": \"card\",\n    \"type\": \"card\"\n  },\n  \"setup_future_usage\": \"off_session\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.whop.com/api/v1/confirmation_tokens")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"billing_details\": {\n    \"address\": {\n      \"city\": \"Austin\",\n      \"country\": \"US\",\n      \"line1\": \"123 Main St\",\n      \"postal_code\": \"78701\"\n    },\n    \"email\": \"buyer@example.com\",\n    \"name\": \"Buyer Name\"\n  },\n  \"payment_method\": {\n    \"card\": {\n      \"brand\": \"visa\",\n      \"last4\": \"4242\",\n      \"token_intent\": \"bt_ti_123\"\n    },\n    \"category\": \"card\",\n    \"type\": \"card\"\n  },\n  \"setup_future_usage\": \"off_session\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.whop.com/api/v1/confirmation_tokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"billing_details\": {\n    \"address\": {\n      \"city\": \"Austin\",\n      \"country\": \"US\",\n      \"line1\": \"123 Main St\",\n      \"postal_code\": \"78701\"\n    },\n    \"email\": \"buyer@example.com\",\n    \"name\": \"Buyer Name\"\n  },\n  \"payment_method\": {\n    \"card\": {\n      \"brand\": \"visa\",\n      \"last4\": \"4242\",\n      \"token_intent\": \"bt_ti_123\"\n    },\n    \"category\": \"card\",\n    \"type\": \"card\"\n  },\n  \"setup_future_usage\": \"off_session\"\n}"

response = http.request(request)
puts response.read_body

{
  "billing_details": {
    "country": "AR",
    "email": "marcus@shinetime.example",
    "name": "Buyer Name",
    "postal_code": "C1043"
  },
  "created_at": "2026-01-01T12:00:00.000Z",
  "expires_at": "2026-01-01T12:00:00.000Z",
  "id": "ctok_xxxxxxxxxxxxxx",
  "object": "confirmation_token",
  "payment_method_preview": {
    "category": "saved",
    "display_name": "Visa •••• 4242",
    "id": "payt_xxxxxxxxxxxxxx",
    "type": "card",
    "bank_debit": {
      "brand": "visa",
      "last4": "4242"
    },
    "card": {
      "brand": "visa",
      "last4": "4242"
    },
    "saved": {
      "brand": "visa",
      "last4": "4242"
    },
    "wallet": {
      "brand": "visa",
      "last4": "4242"
    }
  },
  "setup_future_usage": "off_session",
  "status": "pending"
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

Authorizations

Authorization

string

header

required

An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.

Headers

Idempotency-Key

string

A unique key that makes this request safe to retry. See Idempotent requests.

Maximum string length: 255

Example:

"d9105228-4a08-46b1-8b91-42fed586d383"

Api-Version-Date

string

Pins the request to a dated API version.

Example:

"2026-08-25-2"

Body

application/json

account_id

string

required

The account (biz_) this token is scoped to — the publishable identity.

Example:

"biz_xxxxxxxxxxxxxx"

payment_method

object

required

The collected method: type names the payment method, category names the payload shape, and the category-keyed object carries the payload. Wallets are the exception: their payload rides the type key (apple_pay / google_pay). Send exactly the one payload arm the category selects — extra arms are rejected. Redirect-flow methods (category redirect, bank_transfer, voucher, and redirect wallets like cashapp) collect nothing and send no payload arm.

Show child attributes

billing_details

object

Billing details collected with the method. email is always required; cards additionally require name and an address with line1 and country.

Show child attributes

browser_info

object | null

Screen/runtime facts from the buyer's browser (platform, screen dimensions, language, ...) used for authentication ceremonies. Header-derived fields are captured server-side.

Example:

{
  "browser_time_difference": 0,
  "java_enabled": false,
  "javascript_enabled": false,
  "language": "de-DE"
}

return_url

string | null

Where redirect flows send the buyer, carried onto the confirm that consumes this token.

setup_future_usage

enum<string> | null

The save-consent state your surface displayed when the buyer confirmed. Confirm may vault only if attested here.

Available options:

off_session,

on_session,

null

Example:

"off_session"

Response

confirmation token created from a card token intent

billing_details

object | null

required

Enough of the billing details to raise a customer record and recognise the method — email, name, country and postal code. The street address is collected for the charge but never returned; this endpoint is a display-safe preview.

Show child attributes

created_at

string

required

When the token was created, as an ISO 8601 timestamp.

Example:

"2026-01-01T12:00:00.000Z"

expires_at

string

required

When the token expires, as an ISO 8601 timestamp. Tokens are single-use and short-lived.

Example:

"2026-01-01T12:00:00.000Z"

string

required

Example:

"ctok_xxxxxxxxxxxxxx"

object

string

required

Always confirmation_token.

Example:

"confirmation_token"

payment_method_preview

object

required

Display-only preview of the collected method — never the underlying token.

Show child attributes

setup_future_usage

string | null

required

Save-consent state the element displayed at collection: off_session, on_session, or null. Confirm may vault only if attested here.

Example:

"off_session"

status

enum<string>

required

pending until it is used, then consumed; expired once its short lifetime elapses. Only a pending token can be charged.

Available options:

pending,

consumed,

expired

Example:

"pending"

Introduction

Reference

Webhooks & events

Core Resources

Notifications

Money

Commerce

Partners

Workforce

Tracking

Ads

Media

Identity

Developer

Create Confirmation Token

Authorizations

Headers

Body

Response