Create App

Registers a new app on the Whop developer platform. Apps provide custom experiences that can be added to products.

POST /apps

JavaScript

JavaScript

import Whop from '@whop/sdk';

const client = new Whop({
  apiKey: process.env['WHOP_API_KEY'], // This is the default and can be omitted
});

const app = await client.apps.create({ name: 'Shine Time Booking' });

console.log(app.id);

200

{
  "account": {
    "id": "biz_xxxxxxxxxxxxxx",
    "logo_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "route": "shine-time-holdings",
    "title": "Shine Time Holdings"
  },
  "api_key": {
    "created_at": "2026-01-01T12:00:00.000Z",
    "token": "eyJhbGciOiJFUzI1NiJ9.xxxxxxxxxxxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxx"
  },
  "app_store_description": "Shine Time Booking turns a whop into a booking calendar. Members pick a package, choose a slot that fits the day's route, and pay up front. A reminder goes out the night before and the receipt lands as soon as the job is signed off.",
  "app_type": "b2c_app",
  "banner_image": {
    "url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  },
  "base_url": "https://booking.shinetime.example",
  "businesses_created_count": 5,
  "businesses_created_logo_urls": [
    "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  ],
  "creator": {
    "id": "user_xxxxxxxxxxxxxx",
    "name": "Marcus Webb",
    "username": "marcuswebb"
  },
  "dashboard_path": "/dashboard/[companyId]",
  "default_api_key": {
    "id": "apik_xxxxxxxxxxxxxx",
    "name": "Default",
    "obfuscated_secret_key": "apik_xxxx....xxxx",
    "secret_key": "apik_xxxxxxxxxxxxxx_C0000_C_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  },
  "deployment": {
    "app_id": "app_xxxxxxxxxxxxxx",
    "build_id": "<string>",
    "draft": false,
    "error": "<string>",
    "estimated_duration_ms": 150000,
    "estimated_remaining_ms": 91000,
    "finished_at": 123,
    "phase": "process_archive",
    "progress": 0.39,
    "started_at": 1767268800000,
    "status": "publishing",
    "url": "<string>"
  },
  "description": "Let members book a mobile detailing appointment without leaving your whop.",
  "discover_path": "/discover",
  "domain_id": "whopappdomain0000001",
  "experience_path": "/experiences/[experienceId]",
  "hosted_url": "https://shine-time-booking.whop.app",
  "icon": {
    "url": "https://pub-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.r2.dev/custom-perk-icon.svg"
  },
  "id": "app_xxxxxxxxxxxxxx",
  "marketplace_status": "not_available",
  "name": "Shine Time Booking",
  "oauth_client_type": "public",
  "openapi_path": "/openapi.json",
  "origin": "https://whopappdomain0000001.apps.whop.com",
  "product_id": "prod_xxxxxxxxxxxxxx",
  "production_android_build": {
    "checksum": "xxxxxxxxxxxxxxxx",
    "file_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "apbu_xxxxxxxxxxxxxx",
    "source_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "status": "approved"
  },
  "production_ios_build": {
    "checksum": "xxxxxxxxxxxxxxxx",
    "file_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "apbu_xxxxxxxxxxxxxx",
    "source_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "status": "approved"
  },
  "production_web_build": {
    "checksum": "xxxxxxxxxxxxxxxx",
    "file_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "apbu_xxxxxxxxxxxxxx",
    "source_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "status": "approved"
  },
  "redirect_uris": [
    "https://booking.shinetime.example/oauth/callback"
  ],
  "requested_permissions": [
    {
      "is_required": true,
      "justification": "Creates apps on behalf of the installing company.",
      "permission_action": {
        "action": "company:basic:read",
        "name": "company:basic:read"
      }
    }
  ],
  "required_scopes": [
    "read_user"
  ],
  "route": "shine-time-booking",
  "secrets": {
    "BOOKING_CALENDAR_ID": "cal_9f21"
  },
  "skills_path": "/skills",
  "status": "unlisted",
  "verified": false
}

Authorizations

Authorization · string · header · required

An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.

Headers

Idempotency-Key · string

A unique key that makes this request safe to retry. See Idempotent requests.

Maximum string length: 255

Example:

"d9105228-4a08-46b1-8b91-42fed586d383"

Api-Version-Date · string

Pins the request to a dated API version.

Example:

"2026-08-21"

Body

application/json

name · string · required

The display name for the app, shown to users on the app store and product pages.

Example:

"Shine Time Booking"

account_id · string

The account to create the app for (biz_ tag). Defaults to the account behind the presented credential.

Example:

"biz_xxxxxxxxxxxxxx"

app_type · enum<string> · default: b2c_app

The type of app to create. Defaults to b2c_app.

Available options: b2b_app, b2c_app, company_app, component, website

Example:

"website"

base_url · string | null

The base production URL where the app is hosted, such as https://myapp.example.com.

Example:

"https://booking.shinetime.example"

icon · object

The icon image for the app in PNG, JPEG, or GIF format, referencing an uploaded file: { id } for an existing attachment or { direct_upload_id } for a new direct upload.

Show child attributes

redirect_uris · string[]

The whitelisted OAuth callback URLs that users are redirected to after authorizing the app.

route · string | null

The subdomain route where the app's hosted web builds are served, such as myapp for myapp.whop.app.

Example:

"shine-time-booking-site"

Response

200

application/json

app created

account · object · required

The account that owns the app.

Show child attributes

api_key · object | null · required

Legacy app API key used to authenticate requests on the app's behalf. null when no key exists or the caller lacks the developer:manage_api_key permission.

Show child attributes

app_store_description · string | null · required

Detailed description shown on the app store's in-depth app page, or null when none has been set.

Example:

"Shine Time Booking turns a whop into a booking calendar. Members pick a package, choose a slot that fits the day's route, and pay up front. A reminder goes out the night before and the receipt lands as soon as the job is signed off."

app_type · enum<string> · required

The type of end-user the app is built for.

Available options: b2b_app, b2c_app, company_app, component, website

Example:

"b2c_app"

banner_image · object | null · required

Banner image from the app's product listing, or null when none is uploaded.

Show child attributes

base_url · string | null · required

The production base URL where the app is hosted. null if no base URL is configured, if the caller lacks the developer:basic:read permission on the app's account, or on list responses, which never expose it.

Example:

"https://booking.shinetime.example"

businesses_created_count · integer · required

Website businesses created from this app as a template.

Example:

5

businesses_created_logo_urls · string[] · required

Up to three logo image URLs from businesses created from this app as a template.

creator · object · required

The user who owns the publishing account.

Show child attributes

dashboard_path · string | null · required

URL path for the account dashboard view, or null when not configured.

Example:

"/dashboard/[companyId]"

default_api_key · object | null · required

The app's default API key. null when the app has no default key or the caller lacks the developer:manage_api_key permission; secret_key is additionally null unless the caller could have created the key themselves.

Show child attributes

deployment · object | null · required

What the app has left to publish, and how a publish in flight is going — status is only ever unpublished, publishing, or failed here. null means there is nothing to report: the app is fully published, there is no working copy to publish from, or the caller cannot deploy this app. Tell those apart from the app's own production_web_build.

Show child attributes

description · string | null · required

Short description shown in listings and search results, or null if none has been set.

Example:

"Let members book a mobile detailing appointment without leaving your whop."

discover_path · string | null · required

URL path for the discover view, or null when not configured.

Example:

"/discover"

domain_id · string · required

Subdomain identifier for the app's proxied URL, forming https://{domain_id}.apps.whop.com.

Example:

"whopappdomain0000001"

experience_path · string | null · required

URL path for the member-facing hub view, or null when not configured.

Example:

"/experiences/[experienceId]"

hosted_url · string | null · required

Full URL where the app's hosted web build is served, or null if no route is claimed.

Example:

"https://shine-time-booking.whop.app"

icon · object · required

The app's icon. Falls back to the default app icon when none is uploaded.

Show child attributes

id · string · required

App ID, prefixed app_.

Example:

"app_xxxxxxxxxxxxxx"

marketplace_status · enum<string> | null · required

Approval status of the app's product listing on the Whop app store, or null when the app has no associated product.

Available options: not_available, pending_review, live_marketplace, null

Example:

"not_available"

name · string · required

Display name shown on the app store and in experience navigation.

Example:

"Shine Time Booking"

oauth_client_type · enum<string> · required

How the app authenticates at the OAuth token endpoint.

Available options: public, confidential

Example:

"public"

openapi_path · string | null · required

URL path to the app's OpenAPI spec file, or null when not configured.

Example:

"/openapi.json"

origin · string | null · required

Full origin URL of the app's proxied domain, for example https://ab1c2d3e4f.apps.whop.com.

Example:

"https://whopappdomain0000001.apps.whop.com"

product_id · string | null · required

ID of the app's product listing on the Whop app store, or null when the app has no associated product.

Example:

"prod_xxxxxxxxxxxxxx"

production_android_build · object | null · required

The approved build currently served on Android, or null when none is deployed.

Show child attributes

production_ios_build · object | null · required

The approved build currently served on iOS, or null when none is deployed.

Show child attributes

production_web_build · object | null · required

The approved build currently served on web, or null when none is deployed.

Show child attributes

redirect_uris · string[] · required

Whitelisted OAuth callback URLs users are redirected to after authorizing the app.

requested_permissions · object[] · required

Show child attributes

required_scopes · enum<string>[] · required

Scopes the app asks a user to grant when they authorize it, shown on the consent screen.

Available options: read_user

route · string | null · required

Claimed subdomain route where hosted web builds are served (myapp for myapp.whop.app), or null if no route is claimed.

Example:

"shine-time-booking"

secrets · object | null · required

The app's production secrets as an object of string values, injected into the hosted server runtime. null when the caller lacks the developer:update_app permission.

Example:

{ "BOOKING_CALENDAR_ID": "cal_9f21" }

skills_path · string | null · required

URL path to the app's skills directory, or null when not configured.

Example:

"/skills"

status · enum<string> · required

Visibility on the Whop app store: live is publicly discoverable, unlisted is accessible only via direct link, hidden is not visible anywhere.

Available options: live, unlisted, hidden

Example:

"unlisted"

verified · boolean · required

Whether the app has been verified by Whop and is eligible for the featured apps section.

Example:

false