Whop payment integration: connect Whop checkout to WooCommerce
How a Whop payment integration works end to end: API key, checkout configuration, Whop Elements, signed webhooks and server-side checks, on WooCommerce.
On this page
A Whop payment integration has three moving parts: your server creates something to pay for (a plan or checkout configuration) with a secret API key, the browser shows Whop’s checkout, and your server waits for the signed payment.succeeded webhook before delivering. On WooCommerce, WhopForWoo wires those three parts to WooCommerce orders, so you configure it instead of coding it.
The integration flow
Customer WooCommerce + WhopForWoo Whop
| fills checkout | |
|----------------->| creates pending order |
| |-- checkout configuration ----->| (exact total, order metadata)
| Whop form |<------------- config id -------|
|<-----------------| mounts Whop Elements |
| pays (card / Apple Pay / Google Pay) ----------->|
| |<--- payment.succeeded (signed)-|
| |-- GET /payments/{id} --------->|
| | checks order, amount, currency |
| thank-you page | marks order paid (once) |
Step by step on WooCommerce
1. Set up Whop Payments. In Whop, go to Balances and set up Whop Payments: choose your payout country, complete KYC (personal details, bank account, ID upload).
2. Create an API key. Whop dashboard → developer settings. Note your Account ID (it starts with biz_). Keep the key on the server: WhopForWoo stores it in WordPress settings and never sends it to the browser or writes it to logs.
3. Install WhopForWoo and open WooCommerce → Settings → Payments → Whop. Paste the API key and Account ID.
4. Add the webhook. The settings page shows your endpoint (https://yourstore.com/?wc-api=whop_webhook). In Whop, create a webhook to that URL, subscribe to payment.succeeded, then paste the webhook secret back into the plugin.
5. Choose the checkout mode. Whop Elements (embedded, recommended) or hosted redirect. The Checkout Block always uses the hosted redirect.
6. Test in sandbox. Switch Sandbox mode on, use sandbox keys, place an order, check that the order turns paid and that the webhook appears in Status & Tools → webhook history.
7. Go live. Swap in production keys and the production webhook secret, disable sandbox.
What a safe Whop checkout integration checks
Whop’s guide is clear that the return URL is not proof of payment. WhopForWoo marks an order paid only when all of these hold:
| Check | Why |
|---|---|
| Webhook signature valid (HMAC-SHA256, Standard Webhooks, constant-time comparison) | Rejects forged requests |
| Timestamp within five minutes | Blocks replayed webhooks |
webhook-id not seen before |
Ignores duplicate deliveries |
Payment read back with GET /payments/{id} |
Doesn’t trust the browser |
| Order, site and checkout configuration match | Payment belongs to this order on this store |
| Amount and currency match the order | Stops paying a smaller total for a bigger cart |
| Per-order lock | Order completed once, even if webhook and return page arrive together |
On any mismatch the order goes on hold with a note. A payment charged without a matching order is listed in Status & Tools with its payment ID so you can create the order or refund it in Whop.
Integration details worth knowing
- API version pinned. Requests send a dated
Api-Version-Dateheader, as Whop recommends, so a Whop API change doesn’t silently alter behaviour. - Idempotency keys on creation calls prevent double configurations on retries.
- Currencies. 47 are charged natively; other store currencies are converted to USD at a live rate from
open.er-api.com, with a sanity check on the rate. - Outbound connections: only
api.whop.comand the exchange-rate API. Browsers load Elements fromcdn.whop.com.
Frequently asked questions
What do I need for a Whop payment integration?
A Whop account with Whop Payments set up, an API key and Account ID, a webhook endpoint subscribed to payment.succeeded, and a page to show the checkout. On WooCommerce, WhopForWoo provides the endpoint and the checkout code.
Where do I get my Whop API key?
In your Whop dashboard's developer settings (whop.com/dashboard/developer). Sandbox keys come from sandbox.whop.com; the two environments share no keys, products or webhooks.
How does a Whop checkout integration verify payments?
Whop signs webhooks with the Standard Webhooks format. A safe integration verifies that signature and, ideally, reads the payment back from the API and checks amount, currency and order before fulfilling.
Can I test the integration without real money?
Yes. Whop has a separate sandbox environment (sandbox-api.whop.com), and WhopForWoo has a Sandbox mode switch.