Skip to main content
Whop has four credential types. Which one you need depends on whose data you are reaching and where the code runs. Pick from this table, then scope the credential down before it goes near production.

​
API keys

An Account API key authenticates your server as one account. An App API key authenticates your app across every account that installed it. Both are secrets: keep them server-side. See Choose your key type to create either.

​
Account-scoped user tokens

An account-scoped user token acts as one specific user inside one specific account. Your server mints it with your API key and hands it to your client, so your users reach Whop without ever signing in to Whop. Create one with POST /api/v1/access_tokens, passing company_id, user_id, and the actions you want to allow:
company_id starts with biz_ and user_id starts with user_. Your API key must have permission to reach both. Tokens expire in one hour by default. Set expires_at to change that, up to a three-hour maximum. Mint them on demand rather than caching them.
See Create access token.

​
Scoping a token

scoped_actions is the list of things the token may do. Each entry is a colon-separated action string.
Leave scoped_actions empty or omit it, and the token inherits every permission the minting credential has. A token handed to a browser then carries your API key’s full reach. Always pass an explicit list.
An action must be a subset of the minting credential’s own permissions. You can’t grant what your API key doesn’t have. These actions appear across Whop’s guides today: The API doesn’t publish a fixed list, so treat this as the documented set rather than the complete one. The authoritative bound is always the minting credential’s own permissions.

​
iframe user tokens

When your app renders inside Whop, every same-origin request carries a short-lived JWT in the x-whop-user-token header. You verify it with the SDK to learn who is asking, then check what they may see. You never mint this one. Whop sends it, and you validate it. See Authentication.

​
OAuth tokens

An OAuth token represents a user who signed in to Whop and approved your app for a set of scopes. Unlike an API key, its reach is bounded by what that individual user can do. Use it for Sign in with Whop, and for acting on a user’s behalf against their own account. See OAuth.

​
Scoping checklist

Before a credential reaches production:
  • Pass explicit scoped_actions on every minted token. Never rely on inheritance.
  • Give API keys a custom permission set once you know which endpoints you call, rather than leaving them on Admin.
  • Keep API keys server-side. Only user tokens belong in a client.
  • Mint short-lived tokens on demand instead of caching long-lived ones.
  • Use separate credentials per environment, and check which one you are holding before running anything that moves money.

​
Next steps

Choose your key type

Create an Account or App API key.

Core Concepts

How accounts, users, and permissions relate.

OAuth

The full OAuth 2.1 and PKCE flow.

Test in the sandbox

Try credentials against test data first.