v8

latestOpenAPI 3.1.02026-08-033623795.0 MB

Access tokens

Create access token

Create a short-lived access token for authenticating API requests. When using API key authentication, provide company_id or user_id. When using OAuth, the user is derived from the token. Use this token with Whop's web and mobile embedded components.

post/access_tokens

Request body

company_idstring nullable

The unique identifier of the company to generate the token for, starting with 'biz_'. The API key must have permission to access this company.

expires_atstring date-time nullable

The expiration timestamp for the access token. Defaults to 1 hour from now, with a maximum of 3 hours.

scoped_actionsstring[] nullable

An array of permission scopes to grant to the access token. If empty or omitted, all permissions from the authenticating credential are inherited. Must be a subset of the credential's permissions.

user_idstring nullable

The unique identifier of the user to generate the token for, starting with 'user_'. The API key must have permission to access this user.

Example request

{
  "company_id": "biz_xxxxxxxxxxxxxx",
  "expires_at": "2023-12-01T05:00:00.401Z",
  "user_id": "user_xxxxxxxxxxxxx"
}

Response

A successful response

expires_atstring date-time required

The timestamp after which this access token is no longer valid and must be refreshed.

tokenstring required

The signed JWT access token string to include in API request Authorization headers.

Example response

{
  "expires_at": "2023-12-01T05:00:00.401Z"
}

All 403 operations