Whop API: how it works and how WooCommerce uses it

The Whop API is a REST API at https://api.whop.com/api/v1 that lets your server create checkouts, read payments, issue refunds, manage memberships and receive signed webhooks. You authenticate every request with Authorization: Bearer <API_KEY> and pin the response shape with an Api-Version-Date header.

If you only want Whop payments on a WooCommerce store, you don’t need to write any of the calls below: WhopForWoo makes them for you. This page explains what happens underneath, so you know what you’re configuring.

Whop API basics

A first call to check your key:

curl https://api.whop.com/api/v1/accounts/me \
  -H "Authorization: Bearer $WHOP_API_KEY"

Versioning

Whop versions the API by date. If you send Api-Version-Date, you get the API exactly as it worked on that date, and later breaking changes don’t touch you. Without the header, Whop uses the version pinned on your API key; keys created without a pin fall back to the original 2025-01-01 behavior. An unknown date returns a 400 listing the supported versions.

Pagination

List endpoints return a data array and a page_info object. Pass first for page size, then after with the previous page_info.end_cursor. Stop when page_info.has_next_page is false.

Rate limits

The default limit is 600 requests per minute, counted per API operation and per credential. Exceeding it returns 429 with "type": "rate_limit_exceeded" and a message telling you how long to wait.

Current API vs Legacy API

Whop serves two surfaces. The Current API (docs under /api-reference/) is where new capability lands. The Legacy API stays supported for older integrations. Build on the Current API unless Whop’s stability page lists a resource as Legacy-only.

The Whop API calls a WooCommerce store needs

Taking a WooCommerce payment through Whop comes down to four steps. Here is how WhopForWoo maps them:

1. Create a checkout configuration for the order. When the customer reaches checkout, the plugin creates the WooCommerce order first, then a Whop checkout configuration with the exact cart total and the order reference in metadata. No plans or product IDs to copy into WordPress.
2. Show the payment form. In the classic checkout, Whop Elements loads from cdn.whop.com inside the WooCommerce payment box. Card details stay in Whop’s iframe and never touch your server. The Checkout Block uses Whop’s hosted page instead.
3. Confirm the payment server side. The plugin reads the payment back with GET /payments/{id} and checks order, site, checkout configuration, amount and currency before marking the order paid. The browser is never trusted.
4. Receive the webhook. Whop sends a signed payment.succeeded event to your store. The plugin verifies the signature and completes the order if the customer closed the tab before the return. See Whop webhooks.

Every request is pinned with Api-Version-Date, and creation calls carry an Idempotency-Key, so a retried request never charges twice.

Set up the API connection in WooCommerce

1. Create an API key in your Whop dashboard: Developer → Account API Keys → Create. Step by step: how to get a Whop API key.
2. Copy your Account ID, the biz_… identifier of your Whop business (formerly called Company ID).
3. In WordPress, open WooCommerce → Settings → Payments → Whop and paste the API Key and Account ID.
4. Add the webhook: copy the URL shown on the settings page (https://yourstore.com/?wc-api=whop_webhook), create a webhook in Whop subscribed to payment.succeeded, then paste its secret into Webhook Secret.
5. Test in sandbox before going live. Sandbox Mode is on by default and sends calls to sandbox-api.whop.com. See Whop sandbox.

The API key and webhook secret are stored in WordPress, never sent to the browser and never written to logs.

When to call the Whop API yourself

Use the API directly if you build something WhopForWoo doesn’t cover: syncing memberships to another system, reading payouts, or validating license keys for software you sell. Keep three rules:

• Server only. An API key acts as your whole business. Never put it in JavaScript, a mobile app or a downloadable file.
• Scope the key. Whop’s quickstart uses the Admin role for testing, then tells you to switch to a custom permission set covering only the endpoints you call.
• Never mix environments. Sandbox and production keys look identical. Keep them in separate environment variables.

Troubleshooting common Whop API errors

On a WooCommerce store, failed calls show up in Whop → Status & Tools, with optional logging under WooCommerce → Status → Logs. For checkout-side problems, see Whop payment issues.