In production, your app runs inside the Whop iframe behind a reverse proxy that injects theDocumentation Index
Fetch the complete documentation index at: https://docs.whop.com/llms.txt
Use this file to discover all available pages before exploring further.
x-whop-user-token header on every request. Every Whop app verifies that token via whopsdk.verifyUserToken, so you need the same header on localhost to test against real users. The dev proxy injects it for you.
Pick your setup
Two installation modes. Both ship the same proxy binary; the difference is whether the proxy spawns your dev server or runs alongside it.| Wrapped (Node/JS) | Standalone | |
|---|---|---|
| Best for | Next.js, Express, anything with a node-based dev script | Python, Ruby, Go, anything non-JS |
| How it runs | whop-proxy --command 'next dev' spawns your server | Your server runs separately on a port; the proxy forwards to it |
| Port | One port (proxy + server) | Two ports (proxy on 3000, server on e.g. 5000) |
| Install | pnpm add -D @whop-apps/dev-proxy | pnpm dlx @whop-apps/dev-proxy --standalone (no install needed) |
NextJS / Javascript app
Update your package.json dev script
Update your
package.json dev script to include the proxy.You can update the dev command to match your framework requirements.
You can also wrap other commands with the proxy in a similar way.
Standalone mode (other frameworks)
Proxy Command Options
The proxy can be configured using the following command line options:Next steps
Authentication
Verify the iframe user token in the same code locally and in production.
Listen to webhooks
Forward Whop webhooks to localhost while developing (use ngrok or Cloudflare Tunnel).
Build app views
Set up the iframe entry points your app will render inside.
Request permissions
Configure the scopes your app needs before publishing.

