Hosting - Whop Docs

Whop serves your site straight from your uploaded build. There is no server to configure and no deploy target to point at.

Builds and versions

Every deploy produces a build, and exactly one is production at a time.

whop apps deploy                            # build, upload, promote
whop apps deploy --preview                  # upload only
whop apps builds promote abld_xxxxxxxx      # make a build live

Promoting an older build is the rollback — there’s no separate revert command. In the dashboard, use the Versions tab. The Vite plugin packs your build into the uploaded archive: assets from dist/client are served directly, and dist/server runs your server code.

Secrets

App secrets are encrypted bindings that become environment variables at runtime.

whop apps secrets list
whop apps secrets set --secret MAIL_API_KEY=mail-key-123
whop apps secrets unset --key MAIL_API_KEY

Run these inside a linked project, or pass --app app_xxxxxxxx. whop apps dev injects the same secrets locally, except names that control the local runtime. An environment variable you export yourself always wins. The runtime also sets:

Binding	Purpose
`APP_ID`	The app being served
`BUILD_ID`	The build currently promoted
`WHOP_API_ORIGIN`	The Whop API origin to build requests against
`ASSETS`	Serves your static assets
`REALTIME`	Backs realtime connections

These names are reserved — a secret of the same name is ignored.

Call the Whop API

Server-side fetch calls pass through an outbound proxy that attaches the app’s API key to Whop API requests:

src/routes/api.account.ts

const response = await fetch(`${process.env.WHOP_API_ORIGIN}/api/v1/accounts/me`);
const account = await response.json();

The key never reaches your code, so it can’t be read, logged, or bundled. Requests elsewhere pass through untouched.

Only server-side calls are signed. A browser fetch leaves the visitor’s machine, not your server — route those through your own handler.
Send x-whop-inject-key: none to leave a server-side request unauthenticated.

The injected key belongs to the app’s own business and can’t move money. Payout and transfer reads are granted. Withdrawing funds, sending transfers, and managing payout destinations aren’t, so those return a scope error until you supply your own key. It also authenticates as your business, never as the visitor — for visitor identity, use OAuth.

Logs

The runtime captures every console.log, uncaught exception, and failed request for 7 days.

whop apps logs app_xxxxxxxx
whop apps logs app_xxxxxxxx --level error
whop apps logs app_xxxxxxxx --query "checkout"

Use --created_after and --created_before with ISO 8601 timestamps to select a window. Client-side JavaScript errors aren’t here — they’re in the visitor’s browser console.

Next steps

Track visitors

The pixel is already installed — add your own events.

Blueprints

Start from a working business instead of an empty project.

Accept payments

Sell directly from the site you’re hosting.

CLI reference

Every whop apps command.

​Builds and versions

​Secrets

​Call the Whop API

​Logs

​Next steps

Track visitors

Blueprints

Accept payments

CLI reference

Builds and versions

Secrets

Call the Whop API

Logs

Next steps