Browse the docs

Provider guide

WHOOP: register your app (API v2)
Access Self-serve app in the developer dashboard; capped at 10 members until WHOOP approves the app [OW docs]
Cost Free
Approval Slow in 2026 (catalog note); no published figure
Account A WHOOP account (a member to test with needs an active WHOOP membership)
Managed app Allowed by the catalog
Latido slug whoop
Time ~10 minutes

Steps

  1. Sign in to the WHOOP developer dashboard (from https://developer.whoop.com) and create a team if asked, then a new app [OFF/MEM: menu names].
  2. Fill the form [MEM: field names]:
    • Name, logo, contact emails.
    • Privacy policy URL (public).
    • Redirect URLs: https://api.getlatido.com/connect/callback/whoop.
    • Scopes: tick the ones below; offline is required, or WHOOP issues no refresh token and every connection dies after an hour [OFF].
  3. Save and copy Client ID and Client Secret.
  4. In Latido, Providers → WHOOP → Custom app: paste both and save. Copy the webhook URL https://api.getlatido.com/providers/whoop/webhook/{providerAppId}.
  5. Back in the WHOOP app settings, paste it as the Webhook URL and select model version v2 (UUID ids) [OFF]. Webhooks are dashboard-only; there is no API.
  6. No extra setting: WHOOP signs with your client secret, X-WHOOP-Signature = base64 HMAC-SHA256(client secret, X-WHOOP-Signature-Timestamp + raw body) [OFF].

Scopes

offline read:profile read:body_measurement read:cycles read:recovery read:sleep read:workout [OFF].

Going to production

Submit the app for WHOOP's review from the dashboard. Until it is approved only 10 members can connect [OW docs]. Rate limits: 100 req/min and 10,000 req/day, increases on request [OFF].

Gotchas

  • state must be exactly 8 characters [OFF]; Latido's adapter handles it.
  • Refresh rotates both tokens and invalidates the old access token at once; concurrent refreshes race [OFF].
  • No deauthorization event; revoking via DELETE /v2/user/access also stops webhooks [OFF/OW].

Sources