How to Connect Your App or AI Agent to the Whop API

Yes, Whop has an API, and an account API key is the first thing you need to connect an app or AI agent to it. At Layer3Labs, we build custom agents and integrations for small and mid-sized businesses.

Whop supports five credential types, a sandbox, and webhooks signed with HMAC-SHA256.

The Whop CLI has no sandbox, test or dry-run mode, so set up token scopes and the sandbox before you write code.

How to Connect Whop to Your App or AI Agent

Whop has a REST API at https://api.whop.com/api/v1 with official TypeScript, Python, and Ruby SDKs, plus an MCP server and a CLI that agents can drive.

Create an account API key, test in the sandbox, subscribe to webhooks, then connect your agent through MCP or the CLI:

• 1. Create an account API key in the Whop dashboard under Account API Keys, and keep it server-side.
• 2. Install an official SDK: pnpm add @whop/sdk, pip install whop-sdk or gem install whop_sdk.
• 3. Run your first test call against GET /api/v1/accounts/me to confirm authentication and get your account ID, which starts with biz_.
• 4. Point your integration to the Whop sandbox environment to test checkout flows using designated test card numbers.
• 5. Create a checkout configuration to generate a live purchase_url checkout link.
• 6. Register an endpoint to receive HMAC-SHA256 signed Standard Webhooks and return a 2xx HTTP response within 5 seconds.
• 7. Connect your AI agent using the Whop MCP server or by supplying a WHOP_API_KEY environment variable to the Whop CLI.

Authentication and Credential Scopes

Every HTTP request sent to the Whop Current API requires authentication using a Bearer token in the request headers, as documented in the Whop API overview. Developers create account API keys in the dashboard under Account API Keys, as outlined in the Whop quickstart guide. Whop's docs say to keep these keys server-side and out of browser code, mobile apps, and public repos.

Whop supports five distinct credential types described in the Whop authorization scoping guide: API keys, account-scoped user tokens, account access tokens, iframe user tokens, and OAuth tokens. Minted access tokens expire after one hour by default, with a three-hour maximum. When an integration requests a minted token without defining scoped_actions, that minted credential automatically inherits every permission possessed by the minting parent.

For security when deploying automated workers, restrict access by specifying exact action scopes during credential creation rather than relying on inherited administrative rights.

API Versioning and Rate Limits

Whop versions the API by date: send an Api-Version-Date header such as 2026-07-01 on each request to choose the response shape. If you omit the header, Whop uses the original 2025-01-01 shapes.

The API organizes resources across distinct functional groups: Payments, Money (covering payouts, transfers, cards, swaps, and trades), Commerce, Websites, Ads, Analytics, Communication, Partners, Workforce, Media, and Developer. List endpoints across these groups implement cursor-based pagination. Requests accept first to set page size and after to supply cursor values, returning pagination state in page_info.end_cursor and page_info.has_next_page.

Whop enforces a default rate limit of 600 requests per minute per API operation and API credential across the /api/v1 namespace, as outlined in the Whop troubleshooting documentation. Exceeding this traffic threshold results in an HTTP 429 status code returning an explicit rate_limit_exceeded error payload.

Standard Webhooks and Delivery Architecture

Whop webhooks follow the Standard Webhooks specification and are signed with HMAC-SHA256, as detailed in the Whop webhooks guide. Webhook receiver endpoints must return an HTTP 2xx status code within 5 seconds to be considered successful.

Whop retries a failed delivery 12 times over roughly 71 hours (about 3 days).

Whop delivers each webhook event at least once, so store each webhook-id and skip any event you have already processed before running downstream business logic.

Whop Sandbox Boundaries and Test Cards

Test commerce flows in the Whop sandbox at https://sandbox.whop.com, which uses the sandbox API at https://sandbox-api.whop.com/api/v1. As documented in the Whop sandbox guide, real money never moves inside this environment. The sandbox documentation also illustrates client initialization patterns for Go via github.com/whopio/whopsdk-go/v2 and Rust.

Payouts are not available yet in the test environment, apps and messaging tools should not be used, and only card payments are supported.

Developers simulate checkout results using designated test card numbers on generated payment pages. Entering card number 4242 4242 4242 4242 triggers a successful transaction completion. Entering card number 4000 0000 0000 0002 simulates a declined transaction, allowing teams to verify how their error handlers and webhook receivers respond.

Whop CLI Commands and Agent Automation

Whop announced the Whop CLI on July 21, 2026, described in the Whop CLI launch post as a method to run your business agentically. The Whop CLI overview lists three install commands: curl -fsSL https://whop.com/install.sh | sh, brew install whopio/tap/whop, or npm install -g @whop/cli (npm needs Node.js 22+).

The CLI docs list 69 command groups. In automated pipelines or continuous integration systems, the CLI authenticates non-interactively by reading the WHOP_API_KEY environment variable. Application developers can deploy custom software using whop apps deploy, which builds, type-checks, uploads, and promotes code to production, or pass the --preview flag to upload code without promoting it.

The Whop CLI has no sandbox, test or dry-run mode, so every command an agent runs executes in production.

For autonomous workloads, the CLI provides specialized agent-mode flags documented in the Whop CLI agent mode guide. These include --llms, --schema, token-budget flags, and structured output formatting via --format <toon|json|yaml|md|jsonl>. Running whop skills add syncs Whop's skill files directly into an external agent runtime.

Whop MCP Servers and AI Plugins

Whop provides Model Context Protocol servers to connect AI agents directly to merchant systems, detailed in the Whop AI and MCP guide. The Whop MCP server operates at https://mcp.whop.com/mcp and connects agents to the Current API, while the Whop Docs MCP server runs at https://docs.whop.com/mcp to search documentation. The older /sse endpoint has been retired and returns HTTP 404. The Whop MCP server completes authentication inside the browser, so developers do not place raw API keys into client configuration files. Whop also publishes an installable agent skill catalog at docs.whop.com/.well-known/skills/index.json, plus llms.txt, llms-full.txt and raw Markdown for any docs page.

Consequential MCP operations run in two calls. A preparation call first returns a signed mcp_confirmation_token. The agent must then supply this token alongside an idempotency_key on a second call to execute the action.

Operators can connect Claude by opening Claude.ai and navigating to Settings > Connectors > Add custom connector. Developers using Claude Code can install the official plugin documented in the Claude Code plugin guide by running /plugin marketplace add whopio/plugins followed by /plugin install whop@whop, which requests the admin permission profile. For Grok environments, the Grok plugin guide details installation via grok plugin install whopio/plugins#dist/grok/whop.

Whop also published a blog post titled SpaceXAI names Whop as the business platform behind Grok, Grok Bot, and Cursor dated September 2, 2026. The post says SpaceXAI named Whop as Grok's first full-stack business connector the week before, and that access then expanded to Cursor and Grok Bot. To connect Grok, a user navigates to grok.com/connectors, clicks New Connector, selects Whop, and authorizes the account. Once authorized, Grok can suggest pricing, set up checkout and run ads for a new product inside the chat, according to Whop. For an existing Whop business, Grok can pull live data including revenue, ad performance, pixel data and card spend, Whop says.

Whop is also listed in the Cursor Marketplace under Payments. Whop says both the Grok connector and Cursor integration extend the Whop CLI and have the same skills and tools to perform any CLI action for the authenticated business. Grok Bot exposes Whop as a plugin where users spin up agents with access to business objects, according to Whop. Whop's post states Grok Bot is accessible to Cursor Pro, Pro+, and Ultra, SuperGrok, SuperGrok Plus and Heavy, and Cursor Standard and Premium Teams tiers. For more, see our guides to Cursor pricing, what Grok Bot is and how to use Grok Bot.

Initial Build Priorities and Transaction Fees

When integrating Whop into business operations, create a checkout configuration first. Calling the checkout-configurations create endpoint produces a live purchase_url checkout page. Once checkout generates sales, configure webhooks to automate downstream access provisioning.

Whop does not list a separate recurring subscription fee for accessing its REST API, CLI, or MCP servers on its documentation pages. Costs depend directly on transaction processing volume, payment methods, and account add-ons documented in the Whop fee schedule.

Domestic card payments cost 2.7% + $0.30 per successful transaction. International cards add 1.5%, and currency conversion adds 1% when applicable. ACH debit transactions cost 1.5% with a maximum fee capped at $5. Financing through a partner costs 15% per successful transaction, and 20% for ClarityPay No Interest. Payout fees vary by rail. Next-day ACH costs $2.50, Instant Bank Deposit (RTP) costs 4% + $2.50, crypto transfers cost 5% + $1.00, Venmo costs 5% + $2.50, and a bank wire costs $23.00.

Security and dispute charges include $0.03 for 3DS verification, $0.07 for Radar fraud screening, $15.00 for formal chargeback disputes, and $29.00 for early dispute alerts via RDR. Optional add-ons are orchestration at 0.8%, billing at 0.5%, and tax and remittance at 2% when enabled and tax is collected. When an account enables all add-ons with tax collection active, total processing fees reach 6% + $0.30 per transaction. Pricing policies change over time, so verify current figures directly on the official Whop fees page.

Who this is not for: Teams that need a test mode inside command-line tooling should not hand the Whop CLI to an agent yet, because every command runs in production. Use the sandbox API at https://sandbox-api.whop.com/api/v1, where money never moves, and mint tokens with scoped_actions set.

What would change our verdict: a dry-run mode in the Whop CLI. With one, an agent could rehearse a command before it touches the live business.