Sandbox Mode

Whop provides a fully isolated sandbox environment at sandbox.whop.com for development and testing. Sandbox apps, API keys, plans, products, and users are completely separate from production — nothing you do in sandbox affects live data, and no real charges are made.

This starter supports sandbox mode end to end: OAuth sign-in, API access checks, plan price sync, embedded checkout, the billing portal, and subscription reactivation all target the sandbox hosts when enabled.

Enabling sandbox mode

There are two ways to enable it:

1. Setup wizard

On the Business step of the setup wizard, tick "Use Whop Sandbox (test mode)". The wizard saves whop_environment = sandbox to the database and switches all of its dashboard links to sandbox.whop.com, so the app you create and the plan IDs you paste come from the right place.

2. Environment variable

Power users configuring everything via env vars can set:

NEXT_PUBLIC_WHOP_ENVIRONMENT="sandbox"

Only the exact string sandbox enables sandbox mode — anything else (including unset) means production, so a typo can never silently point a live app at test infrastructure.

What you need in sandbox

Sandbox credentials are not interchangeable with production credentials. Create each of these in the sandbox developer dashboard:

1. A sandbox app — its App ID is your OAuth client ID
2. A sandbox API key — for server-side API calls
3. Sandbox plans — production plan_… IDs will not resolve in sandbox
4. A sandbox webhook — pointing at your /api/webhooks/whop endpoint

Test cards

At checkout, use Whop's test cards (any future expiry, any CVC):

Which hosts are used

Switching to production

When you're ready to go live:

1. Create a production app, plans, and webhook at whop.com/dashboard/developer
2. Replace the App ID, API key, webhook secret, and plan IDs with the production values
3. Set whop_environment to production (or remove NEXT_PUBLIC_WHOP_ENVIRONMENT)

The easiest way is to re-run the setup wizard, or update the values in your environment variables / hosting provider settings.