Authentication

The Whippy REST API at https://api.whippy.co accepts two kinds of credentials. Send exactly one per request. A request with both is rejected.

API keys

Create a key

1. In Whippy, go to Developer → API keys.
2. Select Add key, enter a name that says where the key is used (for example HubSpot sync – production), and save.
3. Copy the key.

You can show, rename, disable, re-enable, or delete keys on the same page.

Use a key

curl https://api.whippy.co/v1/channels \
  -H "X-WHIPPY-KEY: $WHIPPY_API_KEY"

Keep keys safe

• An API key has full access to your organization's public API. Treat it like a password.
• Keep keys on your server. Never put them in browser code, mobile apps, or AI assistant configuration.
• Use a separate key for each integration, so you can disable one without breaking the others.
• If a key leaks, disable or delete it right away and create a new one.

Your API key also verifies webhooks: Whippy signs each webhook request with it in the X-Whippy-Signature header. See Webhooks.

OAuth access tokens

Use OAuth when people connect their own Whippy accounts to your app. Each token acts as the user who approved it, in the workspace they picked, limited by their role and the scopes they granted.

Whippy's authorization server supports the authorization code flow with PKCE for public clients, with dynamic client registration. The endpoints, the registration rules, and the redirect URI allow-list are in How sign-in works.

curl https://api.whippy.co/v1/channels \
  -H "Authorization: Bearer $WHIPPY_ACCESS_TOKEN"

If the token lacks a required scope, the API returns 403 with:

{"error": "Token does not have the required scope for this action."}

Errors