# Whop license key API: how to validate software licenses

> How the Whop license key API works: the Software app, memberships.retrieve with a license key, machine binding with metadata, resets, server-side checks.

Updated: 2026-11-11 · Canonical: https://whopforwoo.com/docs/whop-license-keys

The Whop license key API lets you sell downloadable software on Whop and check each customer's key from your server: every purchase of a product with the **Software** app gets a unique key, and `GET /memberships/{id}` accepts that key in place of a membership ID. You read the membership's status, and you can bind the key to a machine through `metadata`.

We use it ourselves: WhopForWoo licenses are Whop license keys, checked by our own license server. Here is how it works.

## How Whop license keys work

1. **Add the Software app to your product.** Install it on your whop, open it, and enter your software's name and download link. Buyers then see their license key and the download in their Whop orders.
2. **The customer buys.** Whop creates a membership for the purchase. Its `license_key` field is filled only when the product includes the Software app.
3. **Your software asks for the key** and sends it, with a machine identifier, to **your server**.
4. **Your server checks the key with Whop** and answers yes or no.

![Software app settings on a Whop product with name and download link](https://whopforwoo.com/img/whop-software-app-settings.png)

## Validate a license key from your server

Retrieve the membership with the key, then check its status. Whop's own example treats `active`, `trialing` and `completed` as valid; add `past_due` if you want customers to keep access while Whop retries a failed renewal.

```bash
curl https://api.whop.com/api/v1/memberships/LICENSE_KEY \
  -H "Authorization: Bearer $WHOP_API_KEY"
```

With the TypeScript SDK:

```typescript
const VALID = ["active", "trialing", "completed"];

export async function validateLicense(licenseKey: string, hwid: string) {
  // Retrieve accepts a license key in place of a membership ID.
  // An unknown key throws a 404.
  const m = await client.memberships.retrieve({ id: licenseKey });
  if (!VALID.includes(m.status)) return { valid: false, reason: "inactive" };

  const bound = m.metadata?.hwid;
  if (!bound) {
    // Update merges these keys into the existing metadata.
    await client.memberships.update({ id: m.id, metadata: { hwid } });
    return { valid: true };
  }
  return bound === hwid
    ? { valid: true }
    : { valid: false, reason: "bound_to_another_machine" };
}
```

### Bind a key to one machine (HWID)

- **No `hwid` in metadata yet**: save the machine's ID and grant access.
- **Same `hwid`**: grant access.
- **Different `hwid`**: deny access until the key is reset.

### Reset a key

Customers can reset their key themselves from their Whop orders. From your server, update the membership with `metadata: {}`; the next check from any machine binds the key again. Since updates merge metadata, test the reset in the [sandbox](https://whopforwoo.com/docs/whop-sandbox) before relying on it.

## The one rule: never ship your API key

Your Whop API key can read and change every membership in your business. If you embed it in a desktop app, a script or a WordPress plugin, anyone can extract it. Whop's docs are explicit: validate keys from your own server, never from the software you ship.

The pattern is always the same:

```
your software  →  your server (holds WHOP_API_KEY)  →  api.whop.com
```

Your server can also count activations, rate-limit checks, cache answers and sign responses, which a client-side check can't do safely.

## How WhopForWoo uses Whop license keys

When you buy WhopForWoo on Whop, the key you receive is a Whop license key. You paste it into the plugin, and the plugin talks only to our license server at `license.whopforwoo.com`, never to Whop with a secret of ours:

1. **Activate**: the plugin sends the key, your site URL and its version. Our server retrieves the membership from Whop with our API key (kept as a server secret), checks its status, and checks the number of sites against your plan: 1 site (Solo), 5 (Dropshipper) or unlimited (Pirate).
2. **Store the sites**: instead of a hardware ID, we bind keys to **site URLs**, stored with the membership.
3. **Check and update**: the plugin re-checks periodically and fetches updates through short-lived signed download links.
4. **Deactivate**: freeing a site lets you move the license to another store.

Without an active license, the Whop payment method is not offered at checkout in live mode (test mode still works). WhopForWoo licences are a one-time payment and never expire. A network error or an unreachable license server never turns the checkout off: only an explicit "expired" or "revoked" answer counts, and orders already placed keep being processed.

![WhopForWoo license screen with an active key and sites used](https://whopforwoo.com/img/whopforwoo-license-screen.png)

## Building your own licensing on Whop: checklist

- Add the Software app to every product that should issue keys.
- Validate on your server; return a short signed token to the client rather than raw Whop data.
- Decide your valid statuses (`past_due` or not) and write them down.
- Keep metadata small: it is meant for identifiers like an `hwid` or a site list, not documents.
- Subscribe to `membership.updated` webhooks if you need to react to cancellations quickly. See [Whop webhooks](https://whopforwoo.com/docs/whop-webhooks).
- Scope the API key to what the license server needs. See [Whop API key](https://whopforwoo.com/docs/whop-api-key).

Selling a web app rather than a download? Whop's other path, an access check on the user ID, fits better. More on that in [Whop for SaaS](https://whopforwoo.com/whop-for-saas).

Get WhopForWoo: https://whopforwoo.com/pricing

## FAQ

### Does Whop have a license key API?

Yes. When a product includes Whop's Software app, each purchase gets a unique license key. Your server validates it with GET /memberships/{id}, which accepts a license key in place of a membership ID.

### How do I validate a Whop license key?

From your server, retrieve the membership using the license key, check that its status is active, trialing or completed, then optionally compare a machine ID stored in the membership's metadata. An unknown key returns a 404.

### Can I lock a Whop license key to one machine?

Yes. Store a hardware ID (hwid) in the membership's metadata on first use and deny access when a different hwid shows up. Customers can reset the key from their orders, or you can reset it by updating metadata to an empty object.

### Can I put my Whop API key in my app to check licenses?

No. The API key can read and change every membership in your business. Whop's docs say to validate keys from your own server, never from the software you ship.

## Related

- [Whop API: how it works and how WooCommerce uses it](https://whopforwoo.com/docs/whop-api): Whop API explained: base URL, Bearer auth, dated versions, rate limits, pagination and webhooks, plus the calls a WooCommerce store needs to take payments.
- [Whop API key: where to find it and how to get one](https://whopforwoo.com/docs/whop-api-key): How to get a Whop API key: open Developer, create an Account API key, scope it, and paste it into WooCommerce with your Account ID. Sandbox and live.
- [Whop webhook: setup, payment events and webhook secret](https://whopforwoo.com/docs/whop-webhooks): Set up a Whop webhook for WooCommerce: endpoint URL, payment.succeeded event, where to get the webhook secret, signature checks, retries and testing.
- [Whop for SaaS: sell software with Whop license keys](https://whopforwoo.com/whop-for-saas): Whop for SaaS explained: access checks for web apps, license keys for downloadable software, and how we license our own WordPress plugin with Whop.
- [WhopForWoo pricing](https://whopforwoo.com/pricing): WhopForWoo pricing: Solo $129, Dropshipper (5 sites) $249, Pirate (unlimited) $499. One-time payment, updates included. 14-day refund.
- [Whop payment gateway: use Whop to take payments on WooCommerce](https://whopforwoo.com/whop-payment-gateway): Is Whop a payment gateway? Whop is a payment platform and merchant of record. Here is how it works as a WooCommerce gateway and which API calls it uses.