Whop webhook: setup, payment events and webhook secret

A Whop webhook is a signed POST request that Whop sends to your server when something happens, such as payment.succeeded. For WooCommerce, create one webhook pointing to https://yourstore.com/?wc-api=whop_webhook, subscribe it to payment.succeeded, and paste its ws_… secret into the plugin.

That webhook is your safety net: if a customer pays and closes the tab before returning to your store, the order still gets marked paid.

Set up the Whop payment webhook for WooCommerce

1. Copy your webhook URL

In WordPress, open WooCommerce → Settings → Payments → Whop. The webhook URL is shown on the settings page. It is always:

https://yourstore.com/?wc-api=whop_webhook

The URL must be public and use https. Whop rejects localhost and private-network addresses and doesn’t follow redirects, so use your final domain (no http → https or www redirect in between).

2. Create the webhook in Whop

1. Open the Developer page of your Whop dashboard (whop.com/dashboard/developer) and select Create webhook.
2. Paste the URL from step 1.
3. Keep the API version on v1.
4. Select the event payment.succeeded.
5. Save.

Testing first? Do the same in the sandbox dashboard (sandbox.whop.com/dashboard/developer). Sandbox and production webhooks are separate, with separate secrets.

How to get the Whop webhook secret

After you create the webhook, copy the value in the Secret column of the webhooks table. It starts with ws_. Paste it into Webhook Secret in the WhopForWoo settings and save.

• Paste the whole value, ws_ prefix included. Don’t strip it and don’t base64-encode it.
• If you create the webhook through the API (POST /api/v1/webhooks), the response contains webhook_secret only once. Store it immediately.
• A sandbox secret only verifies sandbox events. When you go live, create a production webhook and paste its own secret.

How Whop signs webhooks (and how the plugin checks them)

Whop follows the Standard Webhooks specification. Each request carries three headers:

webhook-id: msg_…
webhook-timestamp: 1786381404
webhook-signature: v1,<base64 signature>

The signature is an HMAC-SHA256 of {webhook-id}.{webhook-timestamp}.{raw body}, keyed with your ws_ secret. Whop’s docs ask receivers to compare it in constant time and to reject requests whose timestamp is more than 5 minutes away from the current time, which blocks replays.

WhopForWoo does exactly that, then goes further:

• Raw body verification before any JSON parsing (parsing first changes the bytes and breaks the check)
• 5-minute replay window and constant-time comparison
• De-duplication on webhook-id: Whop delivers at least once, so the same event can arrive twice; the plugin ignores repeats
• Per-order lock against double completion when the webhook and the customer’s return arrive together
• Amount and currency check: the order is only marked paid if the payment’s order, site, checkout configuration, amount and currency all match
• Shared accounts: payments that belong to another shop on the same Whop account are ignored

The secret is never sent to the browser and never written to logs.

Delivery rules you should know

Whop webhook events

Event names follow resource.action. The ones merchants ask about most:

• Payments: payment.created, payment.succeeded, payment.failed, payment.authorized, payment.canceled, payment.requires_action
• Refunds: refund.created, refund.updated
• Disputes: dispute.created, dispute.updated, dispute_alert.created
• Memberships: membership.activated, membership.updated, membership.trial_ending_soon

The WooCommerce plugin only needs payment.succeeded. Subscribing to more events doesn’t hurt, but those events aren’t used to change orders.

Test the webhook

1. In the Whop dashboard, open the webhook’s menu and send a test event. Whop shows the status code and body your server returned.
2. In WordPress, open Whop → Status & Tools and check the webhook history.
3. Run a full sandbox payment with the test card 4242 4242 4242 4242 (see Whop sandbox) and confirm the order is marked paid.

Troubleshooting

• Nothing arrives: the URL isn’t public, redirects, or belongs to the other environment. Check the delivery log on the webhook in Whop.
• Signature fails: wrong secret, a sandbox secret on a live webhook, or a proxy that rewrites the body.
• Retries pile up: a firewall, security plugin or CDN blocks or delays the POST. Allow requests to /?wc-api=whop_webhook.
• Charged but no order: open Whop → Status & Tools. Payments that couldn’t be matched are listed with their payment ID. More in Whop payment issues.