> ## Documentation Index > Fetch the complete documentation index at: https://docs.whop.com/llms.txt > Use this file to discover all available pages before exploring further. # Create access token > Create a short-lived access token for authenticating API requests. When using API key authentication, provide company_id or user_id. When using OAuth, the user is derived from the token. Use this token with Whop's web and mobile embedded components. ## OpenAPI ````yaml /openapi/api-v1-stable.json post /access_tokens openapi: 3.1.0 info: description: >- The Whop REST API. Please see https://docs.whop.com/developer/api/getting-started for more details. termsOfService: https://whop.com/tos-developer-api/ title: Whop API version: 1.0.0 x-api-version-date: '2026-08-21' servers: - description: Production Whop API url: https://api.whop.com/api/v1 - description: Sandbox Whop API url: https://sandbox-api.whop.com/api/v1 security: [] tags: - description: Products name: Products - description: Payments name: Payments - description: Refunds name: Refunds - description: Disputes name: Disputes - description: Dispute alerts name: Dispute alerts - description: Resolution center cases name: Resolution center cases - description: Checkout configurations name: Checkout configurations - description: Setup intents name: Setup intents - description: Payment methods name: Payment methods - description: Invoices name: Invoices - description: Promo codes name: Promo codes - description: Card transactions name: Card transactions - description: Ledger accounts name: Ledger accounts - description: Withdrawals name: Withdrawals - description: Payout methods name: Payout methods - description: Verifications name: Verifications - description: Identity profiles name: Identity profiles - description: Payout accounts name: Payout accounts - description: Topups name: Topups - description: Companies name: Companies - description: Authorized users name: Authorized users - description: Fee markups name: Fee markups - description: Members name: Members - description: Memberships name: Memberships - description: Leads name: Leads - description: Entries name: Entries - description: Shipments name: Shipments - description: Reviews name: Reviews - description: Company token transactions name: Company token transactions - description: Affiliates name: Affiliates - description: Experiences name: Experiences - description: Forums name: Forums - description: Forum posts name: Forum posts - description: Chat channels name: Chat channels - description: Support channels name: Support channels - description: Messages name: Messages - description: Reactions name: Reactions - description: Dm members name: Dm members - description: Dm channels name: Dm channels - description: Notifications name: Notifications - description: Courses name: Courses - description: Course chapters name: Course chapters - description: Course lessons name: Course lessons - description: Course students name: Course students - description: Course lesson interactions name: Course lesson interactions - description: Apps name: Apps - description: Webhooks name: Webhooks - description: App builds name: App builds - description: Access tokens name: Access tokens - description: Account links name: Account links - description: Files name: Files - description: Ai chats name: Ai chats - description: Bounties name: Bounties - description: Stats name: Stats - description: Conversions name: Conversions - description: Ad reports name: Ad reports paths: /access_tokens: post: tags: - Access tokens summary: Create access token description: >- Create a short-lived access token for authenticating API requests. When using API key authentication, provide company_id or user_id. When using OAuth, the user is derived from the token. Use this token with Whop's web and mobile embedded components. operationId: createAccessToken parameters: [] requestBody: content: application/json: schema: description: Parameters for CreateAccessToken properties: company_id: description: >- The unique identifier of the company to generate the token for, starting with 'biz_'. The API key must have permission to access this company. example: biz_xxxxxxxxxxxxxx type: - string - 'null' expires_at: description: >- The expiration timestamp for the access token. Defaults to 1 hour from now, with a maximum of 3 hours. example: '2023-12-01T05:00:00.401Z' format: date-time type: - string - 'null' scoped_actions: description: >- An array of permission scopes to grant to the access token. If empty or omitted, all permissions from the authenticating credential are inherited. Must be a subset of the credential's permissions. items: description: >- Represents textual data as UTF-8 character sequences. This type is most often used by GraphQL to represent free-form human-readable text. type: string type: - array - 'null' user_id: description: >- The unique identifier of the user to generate the token for, starting with 'user_'. The API key must have permission to access this user. example: user_xxxxxxxxxxxxx type: - string - 'null' required: [] type: object required: false responses: '200': content: application/json: schema: $ref: '#/components/schemas/AccessToken' description: A successful response '400': content: application/json: example: error: code: parameter_missing message: 'Missing required parameter: amount.' param: amount type: invalid_request_error schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Bad request '401': content: application/json: example: error: message: Invalid or missing API key type: unauthorized schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Unauthorized '403': content: application/json: example: error: message: You do not have permission to access this resource type: forbidden schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Forbidden '404': content: application/json: example: error: message: Resource not found type: not_found schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Not found '422': content: application/json: example: error: null schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Verification required '429': content: application/json: example: error: null schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Too many requests '500': content: application/json: example: error: message: An unexpected error occurred type: internal_server_error schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Internal server error security: - bearerAuth: [] x-codeSamples: - lang: JavaScript source: |- import Whop from '@whop/sdk'; const client = new Whop({ apiKey: process.env['WHOP_API_KEY'], // This is the default and can be omitted }); const accessToken = await client.accessTokens.create(); console.log(accessToken.token); components: schemas: AccessToken: description: >- A short-lived access token used to authenticate API requests on behalf of a user. properties: expires_at: description: >- The timestamp after which this access token is no longer valid and must be refreshed. example: '2023-12-01T05:00:00.401Z' format: date-time type: string token: description: >- The signed JWT access token string to include in API request Authorization headers. type: string required: - token - expires_at type: object securitySchemes: bearerAuth: bearerFormat: auth-scheme description: >- An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with `Bearer`, for example `Bearer ***************************`. scheme: bearer type: http ````