Access tokens

Create access token

Changed on

Creates a short-lived access token for Whop's web and mobile embedded components. With API key authentication, pass account_id or user_id; with OAuth, the token is issued for the OAuth user.

post/access_tokens

Request

  • Base URL: https://api.whop.com/api/v1
  • URL: https://api.whop.com/api/v1/access_tokens
  • Auth: HTTP bearer

Request body

account_idstring nullable

The unique identifier of the company to generate the token for, starting with 'biz_'. The API key must have permission to access this company.

expires_atstring date-time nullable

The expiration timestamp for the access token. Defaults to 1 hour from now, with a maximum of 3 hours.

scoped_actionsstring[] nullable

An array of permission scopes to grant to the access token. If empty or omitted, all permissions from the authenticating credential are inherited. Must be a subset of the credential's permissions.

user_idstring nullable

The unique identifier of the user to generate the token for, starting with 'user_'. The API key must have permission to access this user.

Example request

{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "expires_at": "2023-12-01T05:00:00.401Z",
  "user_id": "user_xxxxxxxxxxxxx"
}

Response

A successful response

expires_atstring date-time required

The timestamp after which this access token is no longer valid and must be refreshed.

tokenstring required

The signed JWT access token string to include in API request Authorization headers.

Example response

{
  "expires_at": "2023-12-01T05:00:00.401Z"
}

Changes