Update App

Updates the settings, metadata, or status of an app. Fields that are omitted keep their current value.

PATCH /apps/{id}

JavaScript

JavaScript

import Whop from '@whop/sdk';

const client = new Whop({
  apiKey: process.env['WHOP_API_KEY'], // This is the default and can be omitted
});

const app = await client.apps.update('id');

console.log(app.id);

200

{
  "account": {
    "id": "biz_xxxxxxxxxxxxxx",
    "logo_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "route": "shine-time-holdings",
    "title": "Shine Time Holdings"
  },
  "api_key": {
    "created_at": "2026-01-01T12:00:00.000Z",
    "token": "eyJhbGciOiJFUzI1NiJ9.xxxxxxxxxxxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxx"
  },
  "app_store_description": "Shine Time Booking turns a whop into a booking calendar. Members pick a package, choose a slot that fits the day's route, and pay up front. A reminder goes out the night before and the receipt lands as soon as the job is signed off.",
  "app_type": "b2c_app",
  "banner_image": {
    "url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  },
  "base_url": "https://booking.shinetime.example",
  "businesses_created_count": 5,
  "businesses_created_logo_urls": [
    "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  ],
  "creator": {
    "id": "user_xxxxxxxxxxxxxx",
    "name": "Marcus Webb",
    "username": "marcuswebb"
  },
  "dashboard_path": "/dashboard/[companyId]",
  "default_api_key": {
    "id": "apik_xxxxxxxxxxxxxx",
    "name": "Default",
    "obfuscated_secret_key": "apik_xxxx....xxxx",
    "secret_key": "apik_xxxxxxxxxxxxxx_C0000_C_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  },
  "deployment": {
    "app_id": "app_xxxxxxxxxxxxxx",
    "build_id": "<string>",
    "draft": false,
    "error": "<string>",
    "estimated_duration_ms": 150000,
    "estimated_remaining_ms": 91000,
    "finished_at": 123,
    "phase": "process_archive",
    "progress": 0.39,
    "started_at": 1767268800000,
    "status": "publishing",
    "url": "<string>"
  },
  "description": "Let members book a mobile detailing appointment without leaving your whop.",
  "discover_path": "/discover",
  "domain_id": "whopappdomain0000001",
  "experience_path": "/experiences/[experienceId]",
  "hosted_url": "https://shine-time-booking.whop.app",
  "icon": {
    "url": "https://pub-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.r2.dev/custom-perk-icon.svg"
  },
  "id": "app_xxxxxxxxxxxxxx",
  "marketplace_status": "not_available",
  "name": "Shine Time Booking",
  "oauth_client_type": "public",
  "openapi_path": "/openapi.json",
  "origin": "https://whopappdomain0000001.apps.whop.com",
  "product_id": "prod_xxxxxxxxxxxxxx",
  "production_android_build": {
    "checksum": "xxxxxxxxxxxxxxxx",
    "file_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "apbu_xxxxxxxxxxxxxx",
    "source_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "status": "approved"
  },
  "production_ios_build": {
    "checksum": "xxxxxxxxxxxxxxxx",
    "file_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "apbu_xxxxxxxxxxxxxx",
    "source_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "status": "approved"
  },
  "production_web_build": {
    "checksum": "xxxxxxxxxxxxxxxx",
    "file_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "apbu_xxxxxxxxxxxxxx",
    "source_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "status": "approved"
  },
  "redirect_uris": [
    "https://booking.shinetime.example/oauth/callback"
  ],
  "requested_permissions": [
    {
      "is_required": true,
      "justification": "Creates apps on behalf of the installing company.",
      "permission_action": {
        "action": "company:basic:read",
        "name": "company:basic:read"
      }
    }
  ],
  "required_scopes": [
    "read_user"
  ],
  "route": "shine-time-booking",
  "secrets": {
    "BOOKING_CALENDAR_ID": "cal_9f21"
  },
  "skills_path": "/skills",
  "status": "unlisted",
  "verified": false
}

Authorizations

Authorization · string · header · required

An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.

Headers

Api-Version-Date · string

Pins the request to a dated API version.

Example:

"2026-08-21"

Path Parameters

id · string · required

App ID (prefixed app_), the app's claimed route, or its proxy domain id.

Body

application/json

app_store_description · string

The detailed description shown on the app store's in-depth app view page.

Example:

"Shine Time Booking turns a whop into a booking calendar. Members pick a package, choose a slot that fits the day's route, and pay up front."

app_type · enum<string>

The type of end-user the app is built for. Cannot be changed on an app whose type is already website.

Available options: b2b_app, b2c_app, company_app, component, website

Example:

"b2c_app"

base_url · string | null

The base production URL where the app is hosted. Set to null to take the app proxy offline.

Example:

"https://booking.shinetime.example"

dashboard_path · string | null

The URL path for the account dashboard view.

Example:

"/dashboard/[companyId]"

description · string

A short description of the app shown in listings and search results.

Example:

"Let members book a mobile detailing appointment without leaving your whop."

discover_path · string | null

The URL path for the discover view.

Example:

"/discover"

experience_path · string | null

The URL path for the member-facing hub view, such as /experiences/[experienceId].

Example:

"/experiences/[experienceId]"

icon · object

The icon image for the app in PNG, JPEG, or GIF format, referencing an uploaded file: { id } for an existing attachment or { direct_upload_id } for a new direct upload.

Show child attributes

name · string

The display name for the app, shown to users on the app store and product pages.

Example:

"Shine Time Booking Pro"

oauth_client_type · enum<string>

How the app authenticates at the OAuth token endpoint.

Available options: public, confidential

Example:

"confidential"

openapi_path · string | null

The URL path to the app's OpenAPI spec file (requires the ai_chat capability).

Example:

"/openapi.json"

production_android_build_id · string | null

The app build (abld_ tag) to serve as the Android production build, or null to unassign it. Same rules as production_web_build_id.

Example:

"apbu_xxxxxxxxxxxxxx"

production_ios_build_id · string | null

The app build (abld_ tag) to serve as the iOS production build, or null to unassign it. Same rules as production_web_build_id.

Example:

"apbu_xxxxxxxxxxxxxx"

production_web_build_id · string | null

The app build (abld_ tag) to serve as the web production build, or null to unassign it. The build must belong to this app, target web, and be in the draft or approved status; a draft build is queued for approval and takes over once approved. Requires the developer:manage_builds scope.

Example:

"apbu_xxxxxxxxxxxxxx"

redirect_uris · string[]

The whitelisted OAuth callback URLs users are redirected to after authorizing the app.

required_scopes · string[]

The OAuth scopes the app requests from users when they install it.

route · string

The subdomain route where the app's hosted web builds are served.

Example:

"shine-time-booking-pro"

secrets · object

Secrets to add or overwrite on the app, as an object of string values. Keys not included are left untouched; pass null or an empty string as the value to delete a secret. Encrypted at rest and injected into the app's hosted server runtime.

Example:

{ "BOOKING_CALENDAR_ID": "cal_9f21" }

skills_path · string | null

The URL path to the app's skills directory (requires the ai_chat capability).

Example:

"/skills"

status · enum<string>

Controls whether the app is published on Whop discovery or accessible only through its direct link. Publishing requires a name, icon, and description.

Available options: live, unlisted, hidden

Example:

"unlisted"

Response

200

application/json

app updated

account · object · required

The account that owns the app.

Show child attributes

api_key · object | null · required

Legacy app API key used to authenticate requests on the app's behalf. null when no key exists or the caller lacks the developer:manage_api_key permission.

Show child attributes

app_store_description · string | null · required

Detailed description shown on the app store's in-depth app page, or null when none has been set.

Example:

"Shine Time Booking turns a whop into a booking calendar. Members pick a package, choose a slot that fits the day's route, and pay up front. A reminder goes out the night before and the receipt lands as soon as the job is signed off."

app_type · enum<string> · required

The type of end-user the app is built for.

Available options: b2b_app, b2c_app, company_app, component, website

Example:

"b2c_app"

banner_image · object | null · required

Banner image from the app's product listing, or null when none is uploaded.

Show child attributes

base_url · string | null · required

The production base URL where the app is hosted. null if no base URL is configured, if the caller lacks the developer:basic:read permission on the app's account, or on list responses, which never expose it.

Example:

"https://booking.shinetime.example"

businesses_created_count · integer · required

Website businesses created from this app as a template.

Example:

5

businesses_created_logo_urls · string[] · required

Up to three logo image URLs from businesses created from this app as a template.

creator · object · required

The user who owns the publishing account.

Show child attributes

dashboard_path · string | null · required

URL path for the account dashboard view, or null when not configured.

Example:

"/dashboard/[companyId]"

default_api_key · object | null · required

The app's default API key. null when the app has no default key or the caller lacks the developer:manage_api_key permission; secret_key is additionally null unless the caller could have created the key themselves.

Show child attributes

deployment · object | null · required

What the app has left to publish, and how a publish in flight is going — status is only ever unpublished, publishing, or failed here. null means there is nothing to report: the app is fully published, there is no working copy to publish from, or the caller cannot deploy this app. Tell those apart from the app's own production_web_build.

Show child attributes

description · string | null · required

Short description shown in listings and search results, or null if none has been set.

Example:

"Let members book a mobile detailing appointment without leaving your whop."

discover_path · string | null · required

URL path for the discover view, or null when not configured.

Example:

"/discover"

domain_id · string · required

Subdomain identifier for the app's proxied URL, forming https://{domain_id}.apps.whop.com.

Example:

"whopappdomain0000001"

experience_path · string | null · required

URL path for the member-facing hub view, or null when not configured.

Example:

"/experiences/[experienceId]"

hosted_url · string | null · required

Full URL where the app's hosted web build is served, or null if no route is claimed.

Example:

"https://shine-time-booking.whop.app"

icon · object · required

The app's icon. Falls back to the default app icon when none is uploaded.

Show child attributes

id · string · required

App ID, prefixed app_.

Example:

"app_xxxxxxxxxxxxxx"

marketplace_status · enum<string> | null · required

Approval status of the app's product listing on the Whop app store, or null when the app has no associated product.

Available options: not_available, pending_review, live_marketplace, null

Example:

"not_available"

name · string · required

Display name shown on the app store and in experience navigation.

Example:

"Shine Time Booking"

oauth_client_type · enum<string> · required

How the app authenticates at the OAuth token endpoint.

Available options: public, confidential

Example:

"public"

openapi_path · string | null · required

URL path to the app's OpenAPI spec file, or null when not configured.

Example:

"/openapi.json"

origin · string | null · required

Full origin URL of the app's proxied domain, for example https://ab1c2d3e4f.apps.whop.com.

Example:

"https://whopappdomain0000001.apps.whop.com"

product_id · string | null · required

ID of the app's product listing on the Whop app store, or null when the app has no associated product.

Example:

"prod_xxxxxxxxxxxxxx"

production_android_build · object | null · required

The approved build currently served on Android, or null when none is deployed.

Show child attributes

production_ios_build · object | null · required

The approved build currently served on iOS, or null when none is deployed.

Show child attributes

production_web_build · object | null · required

The approved build currently served on web, or null when none is deployed.

Show child attributes

redirect_uris · string[] · required

Whitelisted OAuth callback URLs users are redirected to after authorizing the app.

requested_permissions · object[] · required

Show child attributes

required_scopes · enum<string>[] · required

Scopes the app asks a user to grant when they authorize it, shown on the consent screen.

Available options: read_user

route · string | null · required

Claimed subdomain route where hosted web builds are served (myapp for myapp.whop.app), or null if no route is claimed.

Example:

"shine-time-booking"

secrets · object | null · required

The app's production secrets as an object of string values, injected into the hosted server runtime. null when the caller lacks the developer:update_app permission.

Example:

{ "BOOKING_CALENDAR_ID": "cal_9f21" }

skills_path · string | null · required

URL path to the app's skills directory, or null when not configured.

Example:

"/skills"

status · enum<string> · required

Visibility on the Whop app store: live is publicly discoverable, unlisted is accessible only via direct link, hidden is not visible anywhere.

Available options: live, unlisted, hidden

Example:

"unlisted"

verified · boolean · required

Whether the app has been verified by Whop and is eligible for the featured apps section.

Example:

false