Authentication

Before using the chat SDK, you need to authenticate users. Pick one of two approaches:

Company-scoped user tokens

Use this approach if your app already has its own users (via your own auth / session system). You keep your existing login flow and mint a Whop token for whichever user is currently signed in — no extra sign-in step.

Your server exchanges your Whop API key for a short-lived user token on demand and returns it to the client. You decide which user the token is for.

1. Gather your credentials

You’ll need three things:

1. API key — create one at the Whop Developer Dashboard. Treat it like a password and keep it on your server only.
2. Company ID — find it in your dashboard URL: whop.com/dashboard/biz_XXXXXXXXX/.
3. User ID — the user you want to authenticate. In production, derive this from your own auth / session system.

2. Create a token endpoint on your server

Add an endpoint that calls POST https://api.whop.com/api/v1/access_tokens with your API key and returns the resulting token to the client.

import { NextResponse } from "next/server";
import Whop from "@whop/sdk";
const client = new Whop({ apiKey: process.env.WHOP_API_KEY });
export async function POST() {
  // Derive these from your own auth / session in production.
  const user_id = "user_XXXXXXXXXXXX";
  const company_id = "biz_XXXXXXXXXXXXX";
  const { token } = await client.accessTokens.create({
    company_id,
    user_id,
    scoped_actions: [
      "chat:message:create",
      "chat:read",
      "dms:read",
      "dms:message:manage",
      "dms:channel:manage",
      "support_chat:read",
      "support_chat:message:create",
    ],
  });
  return NextResponse.json({ token });
}

3. Fetch the token from your app

Provide the SDK with a token callback that fetches from your endpoint. The chat elements call this whenever they need to authenticate, and again automatically when the token expires.

async function getToken() {
  const response = await fetch("/api/chat/token", { method: "POST" });
  const data = await response.json();
  return data.token;
}

Required scopes

Request these scopes when creating the token:

OAuth

OAuth lives on its own page so this guide can stay focused on company-scoped user tokens.

Use OAuth when your app wants users to sign in to Whop themselves through a sign-in page or iOS webview. This is the right choice when your app needs access to a user-owned Whop account, or when you do not want your backend to mint Whop user tokens.