|
1
|
# Whop Route Notes |
|
2
|
|
|
3
|
This file is a fallback reference, not a drop-in implementation. Prefer the |
|
4
|
project's existing server, routing, auth, and database patterns. If a snippet |
|
5
|
doesn't compile in the target app, adapt it instead of preserving the snippet. |
|
6
|
|
|
7
|
## Client Setup |
|
8
|
|
|
9
|
Write `whopClient.ts` to the API server directory from `./references/whopClient.ts`. |
|
10
|
It provides `getWhopClient()` and lazily fetches credentials from the Replit |
|
11
|
connection API. |
|
12
|
|
|
13
|
Install: `pnpm add @whop/sdk` |
|
14
|
|
|
15
|
Most SDK methods require `company_id`; read it from `WHOP_COMPANY_ID`. |
|
16
|
|
|
17
|
## Access Control |
|
18
|
|
|
19
|
For Whop apps, Whop account login is the auth source: |
|
20
|
|
|
21
|
```ts |
|
22
|
const { userId } = await whopsdk.verifyUserToken(req.headers); |
|
23
|
const access = await whopsdk.users.checkAccess(resourceId, { id: userId }); |
|
24
|
if (!access.has_access) { |
|
25
|
return res.status(403).json({ error: 'Access denied' }); |
|
26
|
} |
|
27
|
``` |
|
28
|
|
|
29
|
Use the correct `resourceId` for the thing being protected: |
|
30
|
|
|
31
|
- `prod_xxx` for a product |
|
32
|
- `exp_xxx` for an experience |
|
33
|
- `biz_xxx` for company-level access |
|
34
|
|
|
35
|
Never unlock paid features from a redirect, client-provided email, client-provided |
|
36
|
membership ID, checkout ID, or `success` query parameter. |
|
37
|
|
|
38
|
## Checkout |
|
39
|
|
|
40
|
Use Whop's hosted checkout. The app may create a checkout configuration and |
|
41
|
redirect to `purchase_url`, but access is granted only after Whop verifies the |
|
42
|
current user's account access or a server-verified membership/payment. |
|
43
|
|
|
44
|
## List Payments |
|
45
|
|
|
46
|
List payments for a checkout configuration (useful for verifying purchases): |
|
47
|
|
|
48
|
```ts |
|
49
|
const client = await getWhopClient(); |
|
50
|
const payments = await client.payments.list({ |
|
51
|
company_id: process.env.WHOP_COMPANY_ID, |
|
52
|
checkout_configuration_ids: [checkoutConfigId], |
|
53
|
}); |
|
54
|
``` |
|
55
|
|
|
56
|
REST equivalent via whop-api.mjs: |
|
57
|
|
|
58
|
```bash |
|
59
|
node whop-api.mjs GET '/api/v1/payments?company_id=biz_xxx&checkout_configuration_ids[]=ch_xxx' |
|
60
|
``` |
|
61
|
|
|
62
|
## Manage Subscription |
|
63
|
|
|
64
|
For cancel/modify actions, look up the membership server-side for the verified |
|
65
|
Whop user or authenticated app user. Never accept a membership ID from the |
|
66
|
client as authority to cancel or modify a subscription. |