Sign in
Access tokens

Create access token

Create a short-lived access token for authenticating API requests. When using API key authentication, provide account_id or user_id. When using OAuth, the user is derived from the token. Use this token with Whop's web and mobile embedded components.

post/access_tokens

Request body

account_idstring nullable

The unique identifier of the company to generate the token for, starting with 'biz_'. The API key must have permission to access this company.

expires_atstring date-time nullable

The expiration timestamp for the access token. Defaults to 1 hour from now, with a maximum of 3 hours.

scoped_actionsstring[] nullable

An array of permission scopes to grant to the access token. If empty or omitted, all permissions from the authenticating credential are inherited. Must be a subset of the credential's permissions.

user_idstring nullable

The unique identifier of the user to generate the token for, starting with 'user_'. The API key must have permission to access this user.

Example request

{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "expires_at": "2023-12-01T05:00:00.401Z",
  "user_id": "user_xxxxxxxxxxxxx"
}

Response

A successful response

expires_atstring date-time required

The timestamp after which this access token is no longer valid and must be refreshed.

tokenstring required

The signed JWT access token string to include in API request Authorization headers.

Example response

{
  "expires_at": "2023-12-01T05:00:00.401Z"
}

Changes

Changed in 1 of the 74 revisions of this API.11

  • 697924df40d111See the full diff
    • ●

      removed the request property

      request-property-removed

    • ○

      added the new optional request property

      new-optional-request-property

    This revision also has 9 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Of the 74 revisions, 1 has no diff computed.