Whop license key API: how to validate software licenses

The Whop license key API lets you sell downloadable software on Whop and check each customer’s key from your server: every purchase of a product with the Software app gets a unique key, and GET /memberships/{id} accepts that key in place of a membership ID. You read the membership’s status, and you can bind the key to a machine through metadata.

We use it ourselves: WhopForWoo licenses are Whop license keys, checked by our own license server. Here is how it works.

How Whop license keys work

1. Add the Software app to your product. Install it on your whop, open it, and enter your software’s name and download link. Buyers then see their license key and the download in their Whop orders.
2. The customer buys. Whop creates a membership for the purchase. Its license_key field is filled only when the product includes the Software app.
3. Your software asks for the key and sends it, with a machine identifier, to your server.
4. Your server checks the key with Whop and answers yes or no.

Validate a license key from your server

Retrieve the membership with the key, then check its status. Whop’s own example treats active, trialing and completed as valid; add past_due if you want customers to keep access while Whop retries a failed renewal.

curl https://api.whop.com/api/v1/memberships/LICENSE_KEY \
  -H "Authorization: Bearer $WHOP_API_KEY"

With the TypeScript SDK:

const VALID = ["active", "trialing", "completed"];

export async function validateLicense(licenseKey: string, hwid: string) {
  // Retrieve accepts a license key in place of a membership ID.
  // An unknown key throws a 404.
  const m = await client.memberships.retrieve({ id: licenseKey });
  if (!VALID.includes(m.status)) return { valid: false, reason: "inactive" };

  const bound = m.metadata?.hwid;
  if (!bound) {
    // Update merges these keys into the existing metadata.
    await client.memberships.update({ id: m.id, metadata: { hwid } });
    return { valid: true };
  }
  return bound === hwid
    ? { valid: true }
    : { valid: false, reason: "bound_to_another_machine" };
}

Bind a key to one machine (HWID)

• No hwid in metadata yet: save the machine’s ID and grant access.
• Same hwid: grant access.
• Different hwid: deny access until the key is reset.

Reset a key

Customers can reset their key themselves from their Whop orders. From your server, update the membership with metadata: {}; the next check from any machine binds the key again. Since updates merge metadata, test the reset in the sandbox before relying on it.

The one rule: never ship your API key

Your Whop API key can read and change every membership in your business. If you embed it in a desktop app, a script or a WordPress plugin, anyone can extract it. Whop’s docs are explicit: validate keys from your own server, never from the software you ship.

The pattern is always the same:

your software  →  your server (holds WHOP_API_KEY)  →  api.whop.com

Your server can also count activations, rate-limit checks, cache answers and sign responses, which a client-side check can’t do safely.

How WhopForWoo uses Whop license keys

When you buy WhopForWoo on Whop, the key you receive is a Whop license key. You paste it into the plugin, and the plugin talks only to our license server at license.whopforwoo.com, never to Whop with a secret of ours:

1. Activate: the plugin sends the key, your site URL and its version. Our server retrieves the membership from Whop with our API key (kept as a server secret), checks its status, and checks the number of sites against your plan: 1 site (Solo), 5 (Dropshipper) or unlimited (Pirate).
2. Store the sites: instead of a hardware ID, we bind keys to site URLs, stored with the membership.
3. Check and update: the plugin re-checks periodically and fetches updates through short-lived signed download links.
4. Deactivate: freeing a site lets you move the license to another store.

If a license is missing or expired, payments keep working. Only updates and support stop, with a notice in the WordPress admin. A licensing check should never take a checkout down.

Building your own licensing on Whop: checklist

• Add the Software app to every product that should issue keys.
• Validate on your server; return a short signed token to the client rather than raw Whop data.
• Decide your valid statuses (past_due or not) and write them down.
• Keep metadata small: it is meant for identifiers like an hwid or a site list, not documents.
• Subscribe to membership.updated webhooks if you need to react to cancellations quickly. See Whop webhooks.
• Scope the API key to what the license server needs. See Whop API key.

Selling a web app rather than a download? Whop’s other path, an access check on the user ID, fits better. More on that in Whop for SaaS.