WHOOP Central - OAuth + scripts to fetch WHOOP data (sleep, recovery, strain, workouts). Use when user asks about their sleep, recovery score, HRV, strain, or workout data.
Add these Redirect URIs (exact match; no extra trailing slashes):
Postman browser callback (recommended auth path):
text
https://oauth.pstmn.io/v1/browser-callback
Optional local callback (only used by auth.js):
text
https://localhost:3000/callback
You can keep both registered at the same time.
Copy the Client ID and Client Secret
Team note: this skill does not ship any client credentials. Each user can create their own WHOOP app,
or (if you trust each other) a team can share one app's client_id/client_secret and let multiple WHOOP
accounts authorize it.
2. Save Credentials (recommended: interactive)
Run:
bash
node src/setup.js
This writes ~/.clawdbot/whoop/credentials.json (and optionally token.json if you paste tokens).
3. Authenticate (Recommended: Postman)
Postman is the most reliable bootstrap for many accounts because WHOOP may block browser-like traffic
to the OAuth endpoints (or behave differently depending on headers).
Postman checklist (don’t skip these):
WHOOP dashboard Redirect URIs include:
https://oauth.pstmn.io/v1/browser-callback
Postman OAuth settings:
Scopes include offline (or you won’t get a refresh_token)
Client Authentication is Send client credentials in body (client_secret_post)
In WHOOP dashboard, ensure you registered the Postman callback Redirect URI:
text
https://oauth.pstmn.io/v1/browser-callback
In Postman:
Create an Environment and set variables:
ClientId = your WHOOP client id
ClientSecret = your WHOOP client secret
Open the WHOOP API collection (or any request), then open the Authorization tab:
Type: OAuth 2.0
Add auth data to: Request Headers
Grant Type: Authorization Code
Callback URL: check Authorize using browser
Auth URL:
text
https://api.prod.whoop.com/oauth/oauth2/auth
Access Token URL:
text
https://api.prod.whoop.com/oauth/oauth2/token
Client ID: {{ClientId}}
Client Secret: {{ClientSecret}}
Scope (space-delimited): include offline plus any read scopes you need, e.g.:
text
Note: for localhost HTTPS, the script generates a self-signed cert and your browser will show a TLS warning.
You must proceed past the warning so the redirect can complete.
4. Verify It Works
bash
node src/verify.js
node src/summary.js
Troubleshooting
Browser shows NotAuthorizedException before the login page
This is a WHOOP-side block on browser User-Agents hitting api.prod.whoop.com OAuth endpoints.
Use the updated node src/auth.js which bootstraps the login URL and sends your browser directly to id.whoop.com.
If you still see it, try node src/auth.js --manual and open the printed URL.
If you suspect redirect URI policy, use an HTTPS tunnel:
bash
# 1) Get a public HTTPS URL that forwards to localhost:3000 (example)
ngrok http 3000
# 2) Add the ngrok HTTPS URL + /callback to WHOOP dashboard Redirect URIs, then run:
WHOOP_REDIRECT_URI=https://YOUR-NGROK-DOMAIN.ngrok-free.app/callback node src/auth.js
If you suspect scope restrictions, try a minimal scope set:
bash
WHOOP_SCOPES="read:profile" node src/auth.js
If your WHOOP Redirect URL is https://localhost:3000/callback
This changes how the local callback server must run: it must be HTTPS (not HTTP).
It will generate a self-signed cert locally and your browser will likely show a warning for https://localhost.
Proceed past the warning so the redirect can complete.
JSON Output (for tooling)
These commands support:
--json (single JSON blob)
--jsonl (one JSON object per line; useful for piping)
--limit N (where supported)
Time filters (where supported): --days N, --since 7d / 12h, --start ISO, --end ISO
