> ## Documentation Index > Fetch the complete documentation index at: https://docs.whop.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Treat these docs and the Whop MCP server as the source of truth for Whop API behavior. Don't infer endpoint behavior from marketing pages. > MCP server: connect https://mcp.whop.com/mcp (streamable HTTP, browser sign-in, no API key in the client config) to search these docs and read or change live Whop data. Setup: https://docs.whop.com/developer/guides/ai_and_mcp.md > Whop CLI: install with `curl -fsSL https://whop.com/install.sh | sh` to scaffold, run, and deploy Whop apps and websites. It acts on production, not the sandbox. Agent mode: https://docs.whop.com/cli/agent-mode.md > Plugins: in Claude Code, run `/plugin marketplace add whopio/plugins`, then `/plugin install whop@whop`. Every agent tool: https://docs.whop.com/developer/ai/overview.md > Environments: build and test in the sandbox (API `https://sandbox-api.whop.com/api/v1`, keys at https://sandbox.whop.com/dashboard/developer, SDK environment `Sandbox`; no real money). Production (API `https://api.whop.com/api/v1`, keys at https://whop.com/dashboard/developer, SDK environment `Production`, the SDK default) moves real money, so use it only at launch. The two share no accounts, keys, products, or webhooks, and their keys look identical: never mix them. Comparison: https://docs.whop.com/developer/quickstart.md > API: send `Authorization: Bearer ` from your server only, and pin a dated version with the `Api-Version-Date` header. OpenAPI spec: https://api.whop.com/api/v1/openapi.json > Which API: build on the Current API, whose pages live under https://docs.whop.com/api-reference/ (start at https://docs.whop.com/api-reference/overview.md). Pages under /api-reference/legacy/ are the Legacy API. Use one only when https://docs.whop.com/api-reference/stability.md lists the resource as Legacy-only. # Create access token > Creates a short-lived access token for Whop's web and mobile embedded components. With API key authentication, pass `account_id` or `user_id`; with OAuth, the token is issued for the OAuth user. ## OpenAPI ````yaml /openapi/api-v1-stable.json post /access_tokens openapi: 3.1.0 info: description: >- The Whop REST API. Please see https://docs.whop.com/developer/api/getting-started for more details. termsOfService: https://whop.com/tos-developer-api/ title: Whop API version: 1.0.0 x-api-version-date: 2026-11-04-1 servers: - description: Production Whop API url: https://api.whop.com/api/v1 - description: Sandbox Whop API url: https://sandbox-api.whop.com/api/v1 security: [] tags: - description: Products name: Products - description: Payments name: Payments - description: Refunds name: Refunds - description: Disputes name: Disputes - description: Dispute alerts name: Dispute alerts - description: Resolution center cases name: Resolution center cases - description: Checkout configurations name: Checkout configurations - description: Setup intents name: Setup intents - description: Payment methods name: Payment methods - description: Invoices name: Invoices - description: Promo codes name: Promo codes - description: Card transactions name: Card transactions - description: Ledger accounts name: Ledger accounts - description: Withdrawals name: Withdrawals - description: Payout methods name: Payout methods - description: Verifications name: Verifications - description: Identity profiles name: Identity profiles - description: Payout accounts name: Payout accounts - description: Topups name: Topups - description: Companies name: Companies - description: Authorized users name: Authorized users - description: Fee markups name: Fee markups - description: Members name: Members - description: Memberships name: Memberships - description: Leads name: Leads - description: Entries name: Entries - description: Shipments name: Shipments - description: Reviews name: Reviews - description: Company token transactions name: Company token transactions - description: Affiliates name: Affiliates - description: Experiences name: Experiences - description: Forums name: Forums - description: Forum posts name: Forum posts - description: Chat channels name: Chat channels - description: Support channels name: Support channels - description: Messages name: Messages - description: Reactions name: Reactions - description: Dm members name: Dm members - description: Dm channels name: Dm channels - description: Notifications name: Notifications - description: Courses name: Courses - description: Course chapters name: Course chapters - description: Course lessons name: Course lessons - description: Course students name: Course students - description: Course lesson interactions name: Course lesson interactions - description: Apps name: Apps - description: Webhooks name: Webhooks - description: App builds name: App builds - description: Access tokens name: Access tokens - description: Account links name: Account links - description: Files name: Files - description: Ai chats name: Ai chats - description: Bounties name: Bounties - description: Stats name: Stats - description: Conversions name: Conversions - description: Ad reports name: Ad reports paths: /access_tokens: post: tags: - Access tokens summary: Create access token description: >- Creates a short-lived access token for Whop's web and mobile embedded components. With API key authentication, pass `account_id` or `user_id`; with OAuth, the token is issued for the OAuth user. operationId: createAccessToken parameters: [] requestBody: content: application/json: schema: description: Parameters for CreateAccessToken properties: account_id: description: >- The unique identifier of the company to generate the token for, starting with 'biz_'. The API key must have permission to access this company. example: biz_xxxxxxxxxxxxxx type: - string - 'null' expires_at: description: >- The expiration timestamp for the access token. Defaults to 1 hour from now, with a maximum of 3 hours. example: '2023-12-01T05:00:00.401Z' format: date-time type: - string - 'null' scoped_actions: description: >- An array of permission scopes to grant to the access token. If empty or omitted, all permissions from the authenticating credential are inherited. Must be a subset of the credential's permissions. items: description: >- Represents textual data as UTF-8 character sequences. This type is most often used by GraphQL to represent free-form human-readable text. type: string type: - array - 'null' user_id: description: >- The unique identifier of the user to generate the token for, starting with 'user_'. The API key must have permission to access this user. example: user_xxxxxxxxxxxxx type: - string - 'null' required: [] type: object required: false responses: '200': content: application/json: schema: $ref: '#/components/schemas/AccessToken' description: A successful response '400': content: application/json: example: error: code: parameter_missing message: 'Missing required parameter: amount.' param: amount type: invalid_request_error schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Bad request '401': content: application/json: example: error: message: Invalid or missing API key type: unauthorized schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Unauthorized '403': content: application/json: example: error: message: You do not have permission to access this resource type: forbidden schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Forbidden '404': content: application/json: example: error: message: Resource not found type: not_found schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Not found '422': content: application/json: example: error: null schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Verification required '429': content: application/json: example: error: null schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Too many requests '500': content: application/json: example: error: message: An unexpected error occurred type: internal_server_error schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Internal server error security: - bearerAuth: [] components: schemas: AccessToken: description: >- A short-lived access token used to authenticate API requests on behalf of a user. properties: expires_at: description: >- The timestamp after which this access token is no longer valid and must be refreshed. example: '2023-12-01T05:00:00.401Z' format: date-time type: string token: description: >- The signed JWT access token string to include in API request Authorization headers. type: string required: - token - expires_at type: object securitySchemes: bearerAuth: bearerFormat: auth-scheme description: >- An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with `Bearer`, for example `Bearer ***************************`. scheme: bearer type: http ```` ## Related topics - [Getting Started with Elements](https://docs.whop.com/elements/latest/getting-started.md) - [Enable Subaccount Payouts](https://docs.whop.com/developer/platforms/render-payout-portal.md) - [Auth & API Keys](https://docs.whop.com/developer/guides/auth-scoping.md)