Update API Key

JavaScript

import Whop from '@whop/sdk';

const client = new Whop({
  apiKey: process.env['WHOP_API_KEY'], // This is the default and can be omitted
});

const apiKey = await client.apiKeys.update('id');

console.log(apiKey.id);

curl --request PATCH \
  --url https://api.whop.com/api/v1/api_keys/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "api_version_date": "2026-08-21",
  "expires_at": "2026-01-01T12:00:00.000Z",
  "ip_allowlist": [
    "203.0.113.0/24"
  ],
  "name": "Shine Time Booking (staging)",
  "permissions": {
    "statements": [
      {
        "actions": [
          "company:basic:read"
        ],
        "grant": true,
        "resources": [
          "biz_xxxxxxxxxxxxxx"
        ]
      }
    ],
    "system_role": "admin"
  }
}
'

import requests

url = "https://api.whop.com/api/v1/api_keys/{id}"

payload = {
    "api_version_date": "2026-08-21",
    "expires_at": "2026-01-01T12:00:00.000Z",
    "ip_allowlist": ["203.0.113.0/24"],
    "name": "Shine Time Booking (staging)",
    "permissions": {
        "statements": [
            {
                "actions": ["company:basic:read"],
                "grant": True,
                "resources": ["biz_xxxxxxxxxxxxxx"]
            }
        ],
        "system_role": "admin"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.whop.com/api/v1/api_keys/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'api_version_date' => '2026-08-21',
    'expires_at' => '2026-01-01T12:00:00.000Z',
    'ip_allowlist' => [
        '203.0.113.0/24'
    ],
    'name' => 'Shine Time Booking (staging)',
    'permissions' => [
        'statements' => [
                [
                                'actions' => [
                                                                'company:basic:read'
                                ],
                                'grant' => true,
                                'resources' => [
                                                                'biz_xxxxxxxxxxxxxx'
                                ]
                ]
        ],
        'system_role' => 'admin'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.whop.com/api/v1/api_keys/{id}"

	payload := strings.NewReader("{\n  \"api_version_date\": \"2026-08-21\",\n  \"expires_at\": \"2026-01-01T12:00:00.000Z\",\n  \"ip_allowlist\": [\n    \"203.0.113.0/24\"\n  ],\n  \"name\": \"Shine Time Booking (staging)\",\n  \"permissions\": {\n    \"statements\": [\n      {\n        \"actions\": [\n          \"company:basic:read\"\n        ],\n        \"grant\": true,\n        \"resources\": [\n          \"biz_xxxxxxxxxxxxxx\"\n        ]\n      }\n    ],\n    \"system_role\": \"admin\"\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.whop.com/api/v1/api_keys/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"api_version_date\": \"2026-08-21\",\n  \"expires_at\": \"2026-01-01T12:00:00.000Z\",\n  \"ip_allowlist\": [\n    \"203.0.113.0/24\"\n  ],\n  \"name\": \"Shine Time Booking (staging)\",\n  \"permissions\": {\n    \"statements\": [\n      {\n        \"actions\": [\n          \"company:basic:read\"\n        ],\n        \"grant\": true,\n        \"resources\": [\n          \"biz_xxxxxxxxxxxxxx\"\n        ]\n      }\n    ],\n    \"system_role\": \"admin\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.whop.com/api/v1/api_keys/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"api_version_date\": \"2026-08-21\",\n  \"expires_at\": \"2026-01-01T12:00:00.000Z\",\n  \"ip_allowlist\": [\n    \"203.0.113.0/24\"\n  ],\n  \"name\": \"Shine Time Booking (staging)\",\n  \"permissions\": {\n    \"statements\": [\n      {\n        \"actions\": [\n          \"company:basic:read\"\n        ],\n        \"grant\": true,\n        \"resources\": [\n          \"biz_xxxxxxxxxxxxxx\"\n        ]\n      }\n    ],\n    \"system_role\": \"admin\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "api_version_date": "2026-08-21",
  "created_at": "2026-01-01T12:00:00.000Z",
  "expires_at": "2026-01-01T12:00:00.000Z",
  "id": "apik_xxxxxxxxxxxxxx",
  "ip_allowlist": [
    "203.0.113.0/24"
  ],
  "is_default_for_resource": false,
  "name": "Shine Time Booking (admin role)",
  "obfuscated_secret_key": "apik_xxxx....xxxx",
  "system_role": "admin",
  "updated_at": "2026-01-01T12:00:00.000Z",
  "grants": [
    {
      "actions": [
        {
          "action": "ai_prompt:create",
          "granted": false
        }
      ],
      "resource_id": "biz_xxxxxxxxxxxxxx",
      "resource_type": "account"
    }
  ],
  "secret_key": "apik_xxxxxxxxxxxxxx_C0000_C_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

PATCH

api_keys

{id}

JavaScript

import Whop from '@whop/sdk';

const client = new Whop({
  apiKey: process.env['WHOP_API_KEY'], // This is the default and can be omitted
});

const apiKey = await client.apiKeys.update('id');

console.log(apiKey.id);

curl --request PATCH \
  --url https://api.whop.com/api/v1/api_keys/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "api_version_date": "2026-08-21",
  "expires_at": "2026-01-01T12:00:00.000Z",
  "ip_allowlist": [
    "203.0.113.0/24"
  ],
  "name": "Shine Time Booking (staging)",
  "permissions": {
    "statements": [
      {
        "actions": [
          "company:basic:read"
        ],
        "grant": true,
        "resources": [
          "biz_xxxxxxxxxxxxxx"
        ]
      }
    ],
    "system_role": "admin"
  }
}
'

import requests

url = "https://api.whop.com/api/v1/api_keys/{id}"

payload = {
    "api_version_date": "2026-08-21",
    "expires_at": "2026-01-01T12:00:00.000Z",
    "ip_allowlist": ["203.0.113.0/24"],
    "name": "Shine Time Booking (staging)",
    "permissions": {
        "statements": [
            {
                "actions": ["company:basic:read"],
                "grant": True,
                "resources": ["biz_xxxxxxxxxxxxxx"]
            }
        ],
        "system_role": "admin"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.whop.com/api/v1/api_keys/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'api_version_date' => '2026-08-21',
    'expires_at' => '2026-01-01T12:00:00.000Z',
    'ip_allowlist' => [
        '203.0.113.0/24'
    ],
    'name' => 'Shine Time Booking (staging)',
    'permissions' => [
        'statements' => [
                [
                                'actions' => [
                                                                'company:basic:read'
                                ],
                                'grant' => true,
                                'resources' => [
                                                                'biz_xxxxxxxxxxxxxx'
                                ]
                ]
        ],
        'system_role' => 'admin'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.whop.com/api/v1/api_keys/{id}"

	payload := strings.NewReader("{\n  \"api_version_date\": \"2026-08-21\",\n  \"expires_at\": \"2026-01-01T12:00:00.000Z\",\n  \"ip_allowlist\": [\n    \"203.0.113.0/24\"\n  ],\n  \"name\": \"Shine Time Booking (staging)\",\n  \"permissions\": {\n    \"statements\": [\n      {\n        \"actions\": [\n          \"company:basic:read\"\n        ],\n        \"grant\": true,\n        \"resources\": [\n          \"biz_xxxxxxxxxxxxxx\"\n        ]\n      }\n    ],\n    \"system_role\": \"admin\"\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.whop.com/api/v1/api_keys/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"api_version_date\": \"2026-08-21\",\n  \"expires_at\": \"2026-01-01T12:00:00.000Z\",\n  \"ip_allowlist\": [\n    \"203.0.113.0/24\"\n  ],\n  \"name\": \"Shine Time Booking (staging)\",\n  \"permissions\": {\n    \"statements\": [\n      {\n        \"actions\": [\n          \"company:basic:read\"\n        ],\n        \"grant\": true,\n        \"resources\": [\n          \"biz_xxxxxxxxxxxxxx\"\n        ]\n      }\n    ],\n    \"system_role\": \"admin\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.whop.com/api/v1/api_keys/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"api_version_date\": \"2026-08-21\",\n  \"expires_at\": \"2026-01-01T12:00:00.000Z\",\n  \"ip_allowlist\": [\n    \"203.0.113.0/24\"\n  ],\n  \"name\": \"Shine Time Booking (staging)\",\n  \"permissions\": {\n    \"statements\": [\n      {\n        \"actions\": [\n          \"company:basic:read\"\n        ],\n        \"grant\": true,\n        \"resources\": [\n          \"biz_xxxxxxxxxxxxxx\"\n        ]\n      }\n    ],\n    \"system_role\": \"admin\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "api_version_date": "2026-08-21",
  "created_at": "2026-01-01T12:00:00.000Z",
  "expires_at": "2026-01-01T12:00:00.000Z",
  "id": "apik_xxxxxxxxxxxxxx",
  "ip_allowlist": [
    "203.0.113.0/24"
  ],
  "is_default_for_resource": false,
  "name": "Shine Time Booking (admin role)",
  "obfuscated_secret_key": "apik_xxxx....xxxx",
  "system_role": "admin",
  "updated_at": "2026-01-01T12:00:00.000Z",
  "grants": [
    {
      "actions": [
        {
          "action": "ai_prompt:create",
          "granted": false
        }
      ],
      "resource_id": "biz_xxxxxxxxxxxxxx",
      "resource_type": "account"
    }
  ],
  "secret_key": "apik_xxxxxxxxxxxxxx_C0000_C_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

Authorizations

Authorization

string

header

required

An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.

Headers

Api-Version-Date

string

Pins the request to a dated API version.

Example:

"2026-08-21"

Path Parameters

string

required

API key ID, prefixed apik_.

Body

application/json

api_version_date

enum<string>

Dated API version used when requests authenticated with this key omit the Api-Version-Date header. New keys default to the latest version.

Available options:

2025-01-01,

2026-06-08,

2026-06-09,

2026-06-20,

2026-07-01,

2026-07-08,

2026-07-08-1,

2026-07-18,

2026-07-20,

2026-07-22,

2026-07-23,

2026-07-25,

2026-07-26,

2026-07-27,

2026-07-29,

2026-07-29-1,

2026-07-31,

2026-08-03,

2026-08-05,

2026-08-05-1,

2026-08-10,

2026-08-12,

2026-08-13,

2026-08-14,

2026-08-21

Example:

"2026-08-21"

expires_at

string | null

When the API key should stop working, as an ISO 8601 timestamp. Omit (or pass null on update) for a key that never expires.

Example:

"2026-01-01T12:00:00.000Z"

ip_allowlist

string[] | null

IPv4/IPv6 CIDR ranges allowed to use this key, for example ["203.0.113.0/24"]. Empty or null allows any IP.

name

string | null

A new human-readable name for the API key.

Example:

"Shine Time Booking (staging)"

permissions

object

The permissions policy for the API key: explicit permission statements, or a system role to inherit from. Statements without a resources array default to the owning account (Account API keys) or every key-addressable resource (App API keys).

Show child attributes

Response

api key updated

api_version_date

enum<string>

required

Dated API version used when requests authenticated with this key omit the Api-Version-Date header.

Available options:

2025-01-01,

2026-06-08,

2026-06-09,

2026-06-20,

2026-07-01,

2026-07-08,

2026-07-08-1,

2026-07-18,

2026-07-20,

2026-07-22,

2026-07-23,

2026-07-25,

2026-07-26,

2026-07-27,

2026-07-29,

2026-07-29-1,

2026-07-31,

2026-08-03,

2026-08-05,

2026-08-05-1,

2026-08-10,

2026-08-12,

2026-08-13,

2026-08-14,

2026-08-21

Example:

"2026-08-21"

created_at

string

required

When the API key was created, as an ISO 8601 timestamp.

Example:

"2026-01-01T12:00:00.000Z"

expires_at

string | null

required

When the API key stops working, as an ISO 8601 timestamp. null means it never expires.

Example:

"2026-01-01T12:00:00.000Z"

string

required

API key ID, prefixed apik_.

Example:

"apik_xxxxxxxxxxxxxx"

ip_allowlist

string[] | null

required

IPv4/IPv6 CIDR ranges allowed to use this key. null or empty means requests are accepted from any IP.

is_default_for_resource

boolean

required

Whether this is the resource's default API key. Default keys cannot be updated or deleted, only rotated.

Example:

false

name

string | null

required

Human-readable name identifying the API key, or null when none was set.

Example:

"Shine Time Booking (admin role)"

obfuscated_secret_key

string

required

Masked version of the secret key, so the key can be recognized without revealing the full secret.

Example:

"apik_xxxx....xxxx"

system_role

enum<string> | null

required

System role the key inherits its permissions from, or null when it uses an explicit permissions policy. Only account API keys can use a system role.

Available options:

owner,

admin,

moderator,

sales_manager,

advertiser,

null

Example:

"admin"

updated_at

string

required

When the API key was last updated, as an ISO 8601 timestamp.

Example:

"2026-01-01T12:00:00.000Z"

grants

object[]

Show child attributes

secret_key

string

The full secret used to authenticate requests. Returned only once, on create and rotate responses — store it immediately.

Example:

"apik_xxxxxxxxxxxxxx_C0000_C_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

⌘I

Introduction

Reference

Webhooks & events

Core Resources

Notifications

Money

Commerce

Partners

Workforce

Tracking

Ads

Media

Identity

Developer

Authorizations

Headers

Path Parameters

Body

Response