# Whop API: how it works and how WooCommerce uses it

> Whop API explained: base URL, Bearer auth, dated versions, rate limits, pagination and webhooks, plus the calls a WooCommerce store needs to take payments.

Updated: 2026-11-11 · Canonical: https://whopforwoo.com/docs/whop-api

The Whop API is a REST API at `https://api.whop.com/api/v1` that lets your server create checkouts, read payments, issue refunds, manage memberships and receive signed webhooks. You authenticate every request with `Authorization: Bearer <API_KEY>` and pin the response shape with an `Api-Version-Date` header.

If you only want Whop payments on a WooCommerce store, you don't need to write any of the calls below: WhopForWoo makes them for you. This page explains what happens underneath, so you know what you're configuring.

## Whop API basics

| Item | Value |
|---|---|
| Base URL (production) | `https://api.whop.com/api/v1` |
| Base URL (sandbox) | `https://sandbox-api.whop.com/api/v1` |
| Auth | `Authorization: Bearer <API_KEY>`, server side only |
| Versioning | `Api-Version-Date: YYYY-MM-DD` header |
| Rate limit | 600 requests/minute per operation and credential (default) |
| Errors | HTTP status + `{ "error": { "type", "message" } }` |
| Spec | `https://api.whop.com/api/v1/openapi.json` |
| SDKs | TypeScript (`@whop/sdk`), Python (`whop-sdk`), Ruby |

A first call to check your key:

```bash
curl https://api.whop.com/api/v1/accounts/me \
  -H "Authorization: Bearer $WHOP_API_KEY"
```

### Versioning

Whop versions the API by date. If you send `Api-Version-Date`, you get the API exactly as it worked on that date, and later breaking changes don't touch you. Without the header, Whop uses the version pinned on your API key; keys created without a pin fall back to the original `2025-01-01` behavior. An unknown date returns a `400` listing the supported versions.

### Pagination

List endpoints return a `data` array and a `page_info` object. Pass `first` for page size, then `after` with the previous `page_info.end_cursor`. Stop when `page_info.has_next_page` is false.

### Rate limits

The default limit is 600 requests per minute, counted per API operation and per credential. Exceeding it returns `429` with `"type": "rate_limit_exceeded"` and a message telling you how long to wait.

### Current API vs Legacy API

Whop serves two surfaces. The **Current API** (docs under `/api-reference/`) is where new capability lands. The **Legacy API** stays supported for older integrations. Build on the Current API unless Whop's stability page lists a resource as Legacy-only.

## The Whop API calls a WooCommerce store needs

Taking a WooCommerce payment through Whop comes down to four steps. Here is how WhopForWoo maps them:

1. **Create a checkout configuration for the order.** When the customer reaches checkout, the plugin creates the WooCommerce order first, then a Whop checkout configuration with the exact cart total and the order reference in `metadata`. No plans or product IDs to copy into WordPress.
2. **Show the payment form.** In the classic checkout, Whop Elements loads from `cdn.whop.com` inside the WooCommerce payment box. Card details stay in Whop's iframe and never touch your server. The Checkout Block uses Whop's hosted page instead.
3. **Confirm the payment server side.** The plugin reads the payment back with `GET /payments/{id}` and checks order, site, checkout configuration, amount and currency before marking the order paid. The browser is never trusted.
4. **Receive the webhook.** Whop sends a signed `payment.succeeded` event to your store. The plugin verifies the signature and completes the order if the customer closed the tab before the return. See [Whop webhooks](https://whopforwoo.com/docs/whop-webhooks).

Every request is pinned with `Api-Version-Date`, and creation calls carry an `Idempotency-Key`, so a retried request never charges twice.

![WhopForWoo settings page with API Key, Account ID and Webhook Secret fields](https://whopforwoo.com/img/whopforwoo-api-credentials.png)

## Set up the API connection in WooCommerce

1. **Create an API key** in your Whop dashboard: **Developer → Account API Keys → Create**. Step by step: [how to get a Whop API key](https://whopforwoo.com/docs/whop-api-key).
2. **Copy your Account ID**, the `biz_…` identifier of your Whop business (formerly called Company ID).
3. In WordPress, open **WooCommerce → Settings → Payments → Whop** and paste the **API Key** and **Account ID**.
4. **Add the webhook**: copy the URL shown on the settings page (`https://yourstore.com/?wc-api=whop_webhook`), create a webhook in Whop subscribed to `payment.succeeded`, then paste its secret into **Webhook Secret**.
5. **Test in sandbox** before going live. Sandbox Mode is on by default and sends calls to `sandbox-api.whop.com`. See [Whop sandbox](https://whopforwoo.com/docs/whop-sandbox).

The API key and webhook secret are stored in WordPress, never sent to the browser and never written to logs.

## When to call the Whop API yourself

Use the API directly if you build something WhopForWoo doesn't cover: syncing memberships to another system, reading payouts, or validating [license keys](https://whopforwoo.com/docs/whop-license-keys) for software you sell. Keep three rules:

- **Server only.** An API key acts as your whole business. Never put it in JavaScript, a mobile app or a downloadable file.
- **Scope the key.** Whop's quickstart uses the Admin role for testing, then tells you to switch to a custom permission set covering only the endpoints you call.
- **Never mix environments.** Sandbox and production keys look identical. Keep them in separate environment variables.

## Troubleshooting common Whop API errors

| Status | Usual cause |
|---|---|
| `401` | Wrong or revoked key, or a sandbox key sent to production (or the reverse) |
| `403` | The key's permissions don't cover this endpoint or account |
| `404` | Wrong ID, or the resource belongs to another account or environment |
| `400` | Invalid body, or an unknown `Api-Version-Date` |
| `429` | Rate limit hit: wait the time in the message, then retry |

On a WooCommerce store, failed calls show up in **Whop → Status & Tools**, with optional logging under **WooCommerce → Status → Logs**. For checkout-side problems, see [Whop payment issues](https://whopforwoo.com/whop-payment-issues).

Get WhopForWoo: https://whopforwoo.com/pricing

## FAQ

### Does Whop have an API?

Yes. Whop has a public REST API at https://api.whop.com/api/v1, authenticated with a Bearer API key, plus official SDKs for TypeScript, Python and Ruby. It covers payments, checkout configurations, memberships, refunds, payouts and webhooks.

### Is the Whop API a REST API?

Yes. It is a JSON REST API with conventional HTTP status codes (400, 401, 403, 404, 429), cursor pagination and an OpenAPI spec at https://api.whop.com/api/v1/openapi.json.

### Is there a Whop API v2?

The API you build on today is the Current API under /api/v1, versioned by date with the Api-Version-Date header. 'v2' and 'v5' only survive as legacy webhook payload formats, which Whop tells new integrations not to use.

### Where are the Whop API docs and API reference?

At docs.whop.com/api-reference. Every page is also available as raw Markdown by adding .md to its URL, which is handy for coding agents.

### What is the Whop API rate limit?

The default limit is 600 requests per minute per API operation and per credential. Above it, the API returns HTTP 429 with an error of type rate_limit_exceeded.

## Related

- [Whop API key: where to find it and how to get one](https://whopforwoo.com/docs/whop-api-key): How to get a Whop API key: open Developer, create an Account API key, scope it, and paste it into WooCommerce with your Account ID. Sandbox and live.
- [Whop webhook: setup, payment events and webhook secret](https://whopforwoo.com/docs/whop-webhooks): Set up a Whop webhook for WooCommerce: endpoint URL, payment.succeeded event, where to get the webhook secret, signature checks, retries and testing.
- [Whop sandbox API: test payments before going live](https://whopforwoo.com/docs/whop-sandbox): Whop sandbox API explained: URLs, test API keys, test cards, what doesn't work in sandbox, and how to test a WooCommerce checkout without real money.
- [Whop license key API: how to validate software licenses](https://whopforwoo.com/docs/whop-license-keys): How the Whop license key API works: the Software app, memberships.retrieve with a license key, machine binding with metadata, resets, server-side checks.
- [Whop payment gateway: use Whop to take payments on WooCommerce](https://whopforwoo.com/whop-payment-gateway): Is Whop a payment gateway? Whop is a payment platform and merchant of record. Here is how it works as a WooCommerce gateway and which API calls it uses.
- [Whop embedded checkout: keep customers on your WooCommerce checkout](https://whopforwoo.com/whop-embedded-checkout): How to embed Whop checkout on a website: the Checkout element, what you must build around it, and how WhopForWoo does it inside WooCommerce.