Create Card

TypeScript

import { WhopClient } from "@whop/sdk";

const client = new WhopClient({ token: "YOUR_TOKEN", apiVersionDate: "2026-08-21-1", idempotencyKey: "YOUR_IDEMPOTENCY_KEY" });
await client.cards.create();

curl --request POST \
  --url https://api.whop.com/api/v1/cards \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "assigned_user_id": "user_xxxxxxxxxxxxxx",
  "cardholder": {
    "email": "marcus@shinetime.example",
    "first_name": "Tanya",
    "last_name": "Cole",
    "phone": "+xxxxxxxxxxx"
  },
  "kind": "individual",
  "name": "Detailer card",
  "spend_limit": 500,
  "spend_limit_frequency": "weekly",
  "transaction_limit": 200,
  "user_id": "user_xxxxxxxxxxxxxx"
}
'

import requests

url = "https://api.whop.com/api/v1/cards"

payload = {
    "account_id": "biz_xxxxxxxxxxxxxx",
    "assigned_user_id": "user_xxxxxxxxxxxxxx",
    "cardholder": {
        "email": "marcus@shinetime.example",
        "first_name": "Tanya",
        "last_name": "Cole",
        "phone": "+xxxxxxxxxxx"
    },
    "kind": "individual",
    "name": "Detailer card",
    "spend_limit": 500,
    "spend_limit_frequency": "weekly",
    "transaction_limit": 200,
    "user_id": "user_xxxxxxxxxxxxxx"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    account_id: 'biz_xxxxxxxxxxxxxx',
    assigned_user_id: 'user_xxxxxxxxxxxxxx',
    cardholder: {
      email: 'marcus@shinetime.example',
      first_name: 'Tanya',
      last_name: 'Cole',
      phone: '+xxxxxxxxxxx'
    },
    kind: 'individual',
    name: 'Detailer card',
    spend_limit: 500,
    spend_limit_frequency: 'weekly',
    transaction_limit: 200,
    user_id: 'user_xxxxxxxxxxxxxx'
  })
};

fetch('https://api.whop.com/api/v1/cards', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.whop.com/api/v1/cards",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'account_id' => 'biz_xxxxxxxxxxxxxx',
    'assigned_user_id' => 'user_xxxxxxxxxxxxxx',
    'cardholder' => [
        'email' => 'marcus@shinetime.example',
        'first_name' => 'Tanya',
        'last_name' => 'Cole',
        'phone' => '+xxxxxxxxxxx'
    ],
    'kind' => 'individual',
    'name' => 'Detailer card',
    'spend_limit' => 500,
    'spend_limit_frequency' => 'weekly',
    'transaction_limit' => 200,
    'user_id' => 'user_xxxxxxxxxxxxxx'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.whop.com/api/v1/cards"

	payload := strings.NewReader("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"assigned_user_id\": \"user_xxxxxxxxxxxxxx\",\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"kind\": \"individual\",\n  \"name\": \"Detailer card\",\n  \"spend_limit\": 500,\n  \"spend_limit_frequency\": \"weekly\",\n  \"transaction_limit\": 200,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.whop.com/api/v1/cards")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"assigned_user_id\": \"user_xxxxxxxxxxxxxx\",\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"kind\": \"individual\",\n  \"name\": \"Detailer card\",\n  \"spend_limit\": 500,\n  \"spend_limit_frequency\": \"weekly\",\n  \"transaction_limit\": 200,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.whop.com/api/v1/cards")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"assigned_user_id\": \"user_xxxxxxxxxxxxxx\",\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"kind\": \"individual\",\n  \"name\": \"Detailer card\",\n  \"spend_limit\": 500,\n  \"spend_limit_frequency\": \"weekly\",\n  \"transaction_limit\": 200,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}"

response = http.request(request)
puts response.read_body

{
  "billing": {
    "city": "Austin",
    "country_code": "US",
    "line1": "4180 Burnet Rd",
    "line2": "Suite 210",
    "postal_code": "78756",
    "region": "TX"
  },
  "canceled_at": null,
  "created_at": "2026-01-01T12:00:00.000Z",
  "digital_wallets": [
    "apple_pay"
  ],
  "expiration_month": "12",
  "expiration_year": "2030",
  "id": "icrd_xxxxxxxxxxxxxx",
  "issued": true,
  "last4": "4242",
  "limit": {
    "amount": 2500,
    "frequency": "monthly"
  },
  "name": "Detailing supplies",
  "object": "card",
  "spent_last_month": 0,
  "status": "active",
  "type": "virtual",
  "user_id": "user_xxxxxxxxxxxxxx",
  "secrets": {
    "card_number": "<string>",
    "cvc": "<string>",
    "name_on_card": "<string>",
    "pin": "<string>"
  }
}

{
  "billing": {
    "city": "Austin",
    "country_code": "US",
    "line1": "4180 Burnet Rd",
    "line2": null,
    "postal_code": "78756",
    "region": "TX"
  },
  "canceled_at": null,
  "created_at": "2026-01-01T12:00:00.000Z",
  "digital_wallets": [
    "apple_pay"
  ],
  "expiration_month": null,
  "expiration_year": null,
  "id": "icrd_xxxxxxxxxxxxxx",
  "issued": false,
  "last4": null,
  "limit": {
    "amount": 123,
    "frequency": "daily"
  },
  "name": "Detailer card",
  "object": "card",
  "spent_last_month": 0,
  "status": "invited",
  "type": "virtual",
  "user_id": "user_xxxxxxxxxxxxxx",
  "secrets": {
    "card_number": "<string>",
    "cvc": "<string>",
    "name_on_card": "<string>",
    "pin": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

POST

cards

TypeScript

import { WhopClient } from "@whop/sdk";

const client = new WhopClient({ token: "YOUR_TOKEN", apiVersionDate: "2026-08-21-1", idempotencyKey: "YOUR_IDEMPOTENCY_KEY" });
await client.cards.create();

curl --request POST \
  --url https://api.whop.com/api/v1/cards \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "assigned_user_id": "user_xxxxxxxxxxxxxx",
  "cardholder": {
    "email": "marcus@shinetime.example",
    "first_name": "Tanya",
    "last_name": "Cole",
    "phone": "+xxxxxxxxxxx"
  },
  "kind": "individual",
  "name": "Detailer card",
  "spend_limit": 500,
  "spend_limit_frequency": "weekly",
  "transaction_limit": 200,
  "user_id": "user_xxxxxxxxxxxxxx"
}
'

import requests

url = "https://api.whop.com/api/v1/cards"

payload = {
    "account_id": "biz_xxxxxxxxxxxxxx",
    "assigned_user_id": "user_xxxxxxxxxxxxxx",
    "cardholder": {
        "email": "marcus@shinetime.example",
        "first_name": "Tanya",
        "last_name": "Cole",
        "phone": "+xxxxxxxxxxx"
    },
    "kind": "individual",
    "name": "Detailer card",
    "spend_limit": 500,
    "spend_limit_frequency": "weekly",
    "transaction_limit": 200,
    "user_id": "user_xxxxxxxxxxxxxx"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    account_id: 'biz_xxxxxxxxxxxxxx',
    assigned_user_id: 'user_xxxxxxxxxxxxxx',
    cardholder: {
      email: 'marcus@shinetime.example',
      first_name: 'Tanya',
      last_name: 'Cole',
      phone: '+xxxxxxxxxxx'
    },
    kind: 'individual',
    name: 'Detailer card',
    spend_limit: 500,
    spend_limit_frequency: 'weekly',
    transaction_limit: 200,
    user_id: 'user_xxxxxxxxxxxxxx'
  })
};

fetch('https://api.whop.com/api/v1/cards', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.whop.com/api/v1/cards",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'account_id' => 'biz_xxxxxxxxxxxxxx',
    'assigned_user_id' => 'user_xxxxxxxxxxxxxx',
    'cardholder' => [
        'email' => 'marcus@shinetime.example',
        'first_name' => 'Tanya',
        'last_name' => 'Cole',
        'phone' => '+xxxxxxxxxxx'
    ],
    'kind' => 'individual',
    'name' => 'Detailer card',
    'spend_limit' => 500,
    'spend_limit_frequency' => 'weekly',
    'transaction_limit' => 200,
    'user_id' => 'user_xxxxxxxxxxxxxx'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.whop.com/api/v1/cards"

	payload := strings.NewReader("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"assigned_user_id\": \"user_xxxxxxxxxxxxxx\",\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"kind\": \"individual\",\n  \"name\": \"Detailer card\",\n  \"spend_limit\": 500,\n  \"spend_limit_frequency\": \"weekly\",\n  \"transaction_limit\": 200,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.whop.com/api/v1/cards")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"assigned_user_id\": \"user_xxxxxxxxxxxxxx\",\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"kind\": \"individual\",\n  \"name\": \"Detailer card\",\n  \"spend_limit\": 500,\n  \"spend_limit_frequency\": \"weekly\",\n  \"transaction_limit\": 200,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.whop.com/api/v1/cards")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"assigned_user_id\": \"user_xxxxxxxxxxxxxx\",\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"kind\": \"individual\",\n  \"name\": \"Detailer card\",\n  \"spend_limit\": 500,\n  \"spend_limit_frequency\": \"weekly\",\n  \"transaction_limit\": 200,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}"

response = http.request(request)
puts response.read_body

{
  "billing": {
    "city": "Austin",
    "country_code": "US",
    "line1": "4180 Burnet Rd",
    "line2": "Suite 210",
    "postal_code": "78756",
    "region": "TX"
  },
  "canceled_at": null,
  "created_at": "2026-01-01T12:00:00.000Z",
  "digital_wallets": [
    "apple_pay"
  ],
  "expiration_month": "12",
  "expiration_year": "2030",
  "id": "icrd_xxxxxxxxxxxxxx",
  "issued": true,
  "last4": "4242",
  "limit": {
    "amount": 2500,
    "frequency": "monthly"
  },
  "name": "Detailing supplies",
  "object": "card",
  "spent_last_month": 0,
  "status": "active",
  "type": "virtual",
  "user_id": "user_xxxxxxxxxxxxxx",
  "secrets": {
    "card_number": "<string>",
    "cvc": "<string>",
    "name_on_card": "<string>",
    "pin": "<string>"
  }
}

{
  "billing": {
    "city": "Austin",
    "country_code": "US",
    "line1": "4180 Burnet Rd",
    "line2": null,
    "postal_code": "78756",
    "region": "TX"
  },
  "canceled_at": null,
  "created_at": "2026-01-01T12:00:00.000Z",
  "digital_wallets": [
    "apple_pay"
  ],
  "expiration_month": null,
  "expiration_year": null,
  "id": "icrd_xxxxxxxxxxxxxx",
  "issued": false,
  "last4": null,
  "limit": {
    "amount": 123,
    "frequency": "daily"
  },
  "name": "Detailer card",
  "object": "card",
  "spent_last_month": 0,
  "status": "invited",
  "type": "virtual",
  "user_id": "user_xxxxxxxxxxxxxx",
  "secrets": {
    "card_number": "<string>",
    "cvc": "<string>",
    "name_on_card": "<string>",
    "pin": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

Authorizations

Authorization

string

header

required

An Account API key, an App API key, an account access token, an account-scoped user token, or a user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************. See Auth & API keys for how to get each one.

Headers

Idempotency-Key

string

A unique key that makes this request safe to retry. See Idempotent requests.

Maximum string length: 255

Example:

"d9105228-4a08-46b1-8b91-42fed586d383"

Api-Version-Date

string

Pins the request to a dated API version.

Example:

"2026-11-04-1"

Body

application/json

account_id

string

The owning account ID (a biz_ identifier). Provide this or user_id.

Example:

"biz_xxxxxxxxxxxxxx"

assigned_user_id

string

The account member (a user_ identifier) to assign the card to. Required for business card issuing accounts. When this call files the card application, the member applies with their identity; a company API key that sends neither this nor kind is refused.

Example:

"user_xxxxxxxxxxxxxx"

billing

object

The card's initial billing address. On a company card it also registers the assigned member as a cardholder if they are not one yet. For an individual card, region is also required.

Show child attributes

cardholder

object

Details for a company card's assigned member when they are not registered as a cardholder yet. Send with billing to register them and start provisioning in one call instead of sending them an onboarding invitation. The legal name comes from the member's approved identity verification when they have one, and from these fields when they do not.

Show child attributes

kind

enum<string>

Who the card application verifies, set only on the call that files it; sending it while the account's application is in progress or approved is a 400. business applies as the account with its approved KYB. individual applies as a person: assigned_user_id when given, otherwise the account owner, using the identity verified on the account. Omit it to apply as the business when its KYB is approved, and as an individual otherwise.

Available options:

individual,

business

Example:

"individual"

name

string

A display name for the card.

Example:

"Detailer card"

spend_limit

number

Spending limit amount, in dollars.

Example:

500

spend_limit_frequency

enum<string>

The window the spend limit applies to.

Available options:

daily,

weekly,

monthly,

one_time

Example:

"weekly"

transaction_limit

number

Per-transaction limit amount, in dollars.

Example:

200

user_id

string

The owning user ID (a user_ identifier). Provide this or account_id.

Example:

"user_xxxxxxxxxxxxxx"

Response

card created

billing

object | null

required

The billing address.

Show child attributes

canceled_at

string<date-time> | null

required

When the card was canceled.

Example:

null

created_at

string<date-time> | null

required

When the card was created.

Example:

"2026-01-01T12:00:00.000Z"

digital_wallets

enum<string>[] | null

required

The digital wallets the card has been added to. List Cards, Update Card, and webhook payloads return null, as does Retrieve Card when the wallets cannot be retrieved.

Available options:

apple_pay,

google_pay

expiration_month

string | null

required

Card expiration month.

Example:

"12"

expiration_year

string | null

required

Card expiration year.

Example:

"2030"

string

required

Card ID, prefixed icrd_.

Example:

"icrd_xxxxxxxxxxxxxx"

issued

boolean

required

true once the issuer has issued the card. false for an invited card still waiting on its cardholder's onboarding or review, or one the issuer declined; it has no card number until it is issued.

Example:

true

last4

string | null

required

Last four digits of the card number. null for pending invitation cards.

Example:

"4242"

limit

object | null

required

The spending limit configuration.

Show child attributes

name

string | null

required

Card display name.

Example:

"Detailing supplies"

object

enum<string>

required

Available options:

card

Example:

"card"

spent_last_month

integer | null

required

Total spend in the last 30 days, in cents.

Example:

0

status

enum<string> | null

required

The card status. denied means the issuer declined the cardholder, so the card will never be issued.

Available options:

null,

active,

frozen,

canceled,

invited,

denied

Example:

"active"

type

enum<string> | null

required

The card type.

Available options:

null,

virtual,

physical

Example:

"virtual"

user_id

string | null

required

Cardholder user ID, prefixed user_, when assigned.

Example:

"user_xxxxxxxxxxxxxx"

secrets

object | null

Sensitive card details. Present only on GET /cards/:id for active cards; null when the card is inactive or details cannot be retrieved.

Show child attributes

Introduction

Reference

Core Resources

Payments

Money

Commerce

Websites

Ads

Analytics

Communication

Partners

Workforce

Media

Developer

Authorizations

Headers

Body

Response