Documentation

Whop guide

Create a webhook for payment.succeeded, refund.created, and refund.updated; pin its API version. Use the entire literal ws_... signing secret as UTF-8 HMAC key. Signatures are Standard Webhooks v1,<base64> over webhook-id.webhook-timestamp.rawBody; reject signed timestamps more than five minutes in either direction. The SDK preserves the literal bytes, including prefixes, rather than applying generic Standard Webhooks secret decoding. Official webhook guide, official verifier.

Current payments use data.id, total.amount as a decimal major-unit string, total.currency, total.decimals, scalar product_id and member_id, metadata, and paid_at. billing_reason=subscription_cycle marks renewals. Version-pinned legacy payments use a numeric major-unit total, currency, and expanded product.id. Current payment webhook, version migration.

Only successful refunds count; created and updated deliveries share one refund transaction ID. Documented webhook payloads use legacy numeric amount, currency and expanded payment.id. Native Money-shaped refund payloads are also accepted when present, using the settlement amount, never the distinct processor-currency original_amount. A missing settled amount fails closed. Refund webhook, legacy webhook shape, native refund fields.

Pass ml_visitor_id and ml_session_id using checkout configuration metadata or the Elements checkout metadata option. No official arbitrary hosted-link metadata query scheme was established, so Whop links are not auto-tagged. Checkout configurations, Elements checkout.

No live endpoint/version pin was exercised. Native refund Money fields are documented for the REST resource; actual webhook delivery remains represented by the legacy schema in the current official SDK. The fixtures explicitly cover both shapes without claiming a native webhook was observed.