# Whop webhook: setup, payment events and webhook secret

> Set up a Whop webhook for WooCommerce: endpoint URL, payment.succeeded event, where to get the webhook secret, signature checks, retries and testing.

Updated: 2026-11-11 · Canonical: https://whopforwoo.com/docs/whop-webhooks

A Whop webhook is a signed `POST` request that Whop sends to your server when something happens, such as `payment.succeeded`. For WooCommerce, create one webhook pointing to `https://yourstore.com/?wc-api=whop_webhook`, subscribe it to `payment.succeeded`, and paste its `ws_…` secret into the plugin.

That webhook is your safety net: if a customer pays and closes the tab before returning to your store, the order still gets marked paid.

## Set up the Whop payment webhook for WooCommerce

### 1. Copy your webhook URL

In WordPress, open **WooCommerce → Settings → Payments → Whop**. The webhook URL is shown on the settings page. It is always:

```
https://yourstore.com/?wc-api=whop_webhook
```

The URL must be public and use `https`. Whop rejects `localhost` and private-network addresses and doesn't follow redirects, so use your final domain (no `http` → `https` or `www` redirect in between).

![Webhook URL shown on the WhopForWoo settings page](https://whopforwoo.com/img/whopforwoo-webhook-url.png)

### 2. Create the webhook in Whop

1. Open the **Developer** page of your Whop dashboard (`whop.com/dashboard/developer`) and select **Create webhook**.
2. Paste the URL from step 1.
3. Keep the API version on **v1**.
4. Select the event **`payment.succeeded`**.
5. Save.

Testing first? Do the same in the sandbox dashboard (`sandbox.whop.com/dashboard/developer`). Sandbox and production webhooks are separate, with separate secrets.

![Create webhook form in Whop with payment.succeeded selected](https://whopforwoo.com/img/whop-create-webhook.png)

## How to get the Whop webhook secret

After you create the webhook, copy the value in the **Secret** column of the webhooks table. It starts with `ws_`. Paste it into **Webhook Secret** in the WhopForWoo settings and save.

- Paste the whole value, `ws_` prefix included. Don't strip it and don't base64-encode it.
- If you create the webhook through the API (`POST /api/v1/webhooks`), the response contains `webhook_secret` **only once**. Store it immediately.
- A sandbox secret only verifies sandbox events. When you go live, create a production webhook and paste its own secret.

![Secret column of the Whop webhooks table](https://whopforwoo.com/img/whop-webhook-secret.png)

## How Whop signs webhooks (and how the plugin checks them)

Whop follows the [Standard Webhooks](https://github.com/standard-webhooks/standard-webhooks) specification. Each request carries three headers:

```
webhook-id: msg_…
webhook-timestamp: 1786381404
webhook-signature: v1,<base64 signature>
```

The signature is an HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{raw body}`, keyed with your `ws_` secret. Whop's docs ask receivers to compare it in constant time and to reject requests whose timestamp is more than 5 minutes away from the current time, which blocks replays.

WhopForWoo does exactly that, then goes further:

- **Raw body verification** before any JSON parsing (parsing first changes the bytes and breaks the check)
- **5-minute replay window** and constant-time comparison
- **De-duplication on `webhook-id`**: Whop delivers at least once, so the same event can arrive twice; the plugin ignores repeats
- **Per-order lock** against double completion when the webhook and the customer's return arrive together
- **Amount and currency check**: the order is only marked paid if the payment's order, site, checkout configuration, amount and currency all match
- **Shared accounts**: payments that belong to another shop on the same Whop account are ignored

The secret is never sent to the browser and never written to logs.

## Delivery rules you should know

| Rule | What it means for your store |
|---|---|
| Answer `2xx` within 5 seconds | Slow servers or security plugins that challenge requests cause retries |
| At-least-once delivery | Duplicates are normal; handlers must be idempotent |
| 12 retries over about 71 hours | 30 s, 2 min, 8 min, 30 min, 1 h, 3 h, 6 h, then every 12 h |
| No guaranteed order | A newer event can arrive before an older one |
| Auto-disable | Warning email after 24 h of failures; disabled after 72 h with 10+ failed deliveries |
| 30-day delivery log | Request, response code, body and timing per attempt |

## Whop webhook events

Event names follow `resource.action`. The ones merchants ask about most:

- **Payments**: `payment.created`, `payment.succeeded`, `payment.failed`, `payment.authorized`, `payment.canceled`, `payment.requires_action`
- **Refunds**: `refund.created`, `refund.updated`
- **Disputes**: `dispute.created`, `dispute.updated`, `dispute_alert.created`
- **Memberships**: `membership.activated`, `membership.updated`, `membership.trial_ending_soon`

The WooCommerce plugin only needs `payment.succeeded`. Subscribing to more events doesn't hurt, but those events aren't used to change orders.

## Test the webhook

1. In the Whop dashboard, open the webhook's menu and send a **test event**. Whop shows the status code and body your server returned.
2. In WordPress, open **Whop → Status & Tools** and check the **webhook history**.
3. Run a full sandbox payment with the test card `4242 4242 4242 4242` (see [Whop sandbox](https://whopforwoo.com/docs/whop-sandbox)) and confirm the order is marked paid.

## Troubleshooting

- **Nothing arrives**: the URL isn't public, redirects, or belongs to the other environment. Check the delivery log on the webhook in Whop.
- **Signature fails**: wrong secret, a sandbox secret on a live webhook, or a proxy that rewrites the body.
- **Retries pile up**: a firewall, security plugin or CDN blocks or delays the POST. Allow requests to `/?wc-api=whop_webhook`.
- **Charged but no order**: open **Whop → Status & Tools**. Payments that couldn't be matched are listed with their payment ID. More in [Whop payment issues](https://whopforwoo.com/whop-payment-issues).

Get WhopForWoo: https://whopforwoo.com/pricing

## FAQ

### How do I get the Whop webhook secret?

Create the webhook on the Developer page of your Whop dashboard, then copy the value from the Secret column of the webhooks table. It starts with ws_. If you create the webhook through the API, the secret is returned only once, in the webhook_secret field.

### Which Whop webhook event do I need for payments?

payment.succeeded. It fires when a payment goes through and carries the full payment object. WhopForWoo only needs that event to complete WooCommerce orders.

### How does Whop sign webhooks?

Whop follows the Standard Webhooks spec: an HMAC-SHA256 of webhook-id, webhook-timestamp and the raw body, keyed with your ws_ secret, sent base64-encoded in the webhook-signature header as v1,<signature>.

### Does Whop retry failed webhooks?

Yes. A delivery fails unless your endpoint answers 2xx within 5 seconds. Whop retries 12 times over about 71 hours and disables an endpoint that keeps failing for 72 hours with 10 or more failed deliveries.

### What Whop webhook events exist?

Events are named resource.action: payment.succeeded, payment.failed, payment.created, refund.created, dispute.created, membership.activated, membership.updated and many more, listed in the Whop webhooks guide.

## Related

- [Whop API: how it works and how WooCommerce uses it](https://whopforwoo.com/docs/whop-api): Whop API explained: base URL, Bearer auth, dated versions, rate limits, pagination and webhooks, plus the calls a WooCommerce store needs to take payments.
- [Whop API key: where to find it and how to get one](https://whopforwoo.com/docs/whop-api-key): How to get a Whop API key: open Developer, create an Account API key, scope it, and paste it into WooCommerce with your Account ID. Sandbox and live.
- [Whop sandbox API: test payments before going live](https://whopforwoo.com/docs/whop-sandbox): Whop sandbox API explained: URLs, test API keys, test cards, what doesn't work in sandbox, and how to test a WooCommerce checkout without real money.
- [Whop payment issues: causes and fixes](https://whopforwoo.com/whop-payment-issues): Whop payment issues fixed: card declines, 3D Secure, missing payment methods, Apple Pay not showing, form not loading, and paid orders not updating.
- [Is Whop checkout safe? What protects buyers and merchants](https://whopforwoo.com/is-whop-checkout-safe): Is Whop checkout safe and legit? Card fields, 3D Secure, fraud screening, disputes and reserves explained, plus what a store integration must check.
- [Whop embedded checkout: keep customers on your WooCommerce checkout](https://whopforwoo.com/whop-embedded-checkout): How to embed Whop checkout on a website: the Checkout element, what you must build around it, and how WhopForWoo does it inside WooCommerce.