Whoop.Sdk 2.0.0

Whoop.Sdk

A dependency-light .NET client for the WHOOP v2 Developer API, generated by hand from the published OpenAPI document at https://api.prod.whoop.com/developer/doc/openapi.json.

• Targets netstandard2.0, netstandard2.1, net8.0 and net10.0 — usable from .NET Framework 4.6.2+, .NET Core, .NET 5 through .NET 10, Xamarin, MAUI, Unity and Mono.
• Complete v2 surface: cycles, sleep, recovery, workouts, user profile and body measurements, the v1 activity ID mapping, and the trusted-partner lab endpoints.
• OAuth2 built in: authorization-code URL building, code exchange, automatic refresh with rotation, and the partner client-credentials flow.
• Cursor pagination as IAsyncEnumerable<T> so you can await foreach a whole date range.
• No dependencies at all on net8.0 and net10.0 — System.Text.Json and IAsyncEnumerable<T> are in-box there. The .NET Standard targets add System.Text.Json and Microsoft.Bcl.AsyncInterfaces, and nothing else.

Target frameworks

There is no dedicated net9.0 asset and none is needed: a net9.0 app resolves the net8.0 one, still dependency-free. .NET 9 was STS and reached end of support on 12 May 2026.

The Microsoft.Extensions.* versions in the DI package are a floor, not a pin: an app already on a newer patch or major resolves upward.

Packages

Package	Purpose	Latest
Whoop.Sdk	The client itself.
Whoop.Sdk.Extensions.DependencyInjection	IServiceCollection / IHttpClientFactory wiring.

dotnet add package Whoop.Sdk
dotnet add package Whoop.Sdk.Extensions.DependencyInjection   # only if you want the DI wiring

Quick start

using Whoop.Sdk;
using Whoop.Sdk.Models;

using var whoop = new WhoopClient("<access-token>");

var profile = await whoop.User.GetBasicProfileAsync();
Console.WriteLine($"{profile.FirstName} {profile.LastName}");

var recovery = await whoop.Recovery.ListAsync(new WhoopCollectionRequest { Limit = 10 });
foreach (var record in recovery.Records)
{
    Console.WriteLine($"{record.CreatedAt:d}: {record.Score?.RecoveryScorePercentage}%");
}

Streaming a date range

EnumerateAsync follows the next_token cursor for you and only fetches a page when you consume one.

var lastMonth = new WhoopCollectionRequest
{
    Start = DateTimeOffset.UtcNow.AddDays(-30),
    Limit = 25,
};

await foreach (var workout in whoop.Workouts.EnumerateAsync(lastMonth))
{
    Console.WriteLine($"{workout.SportName} - strain {workout.Score?.Strain:F1}");
}

Authentication

Authorization code flow

using Whoop.Sdk.Authentication;

using var http = new HttpClient();
var oauth = new WhoopOAuthClient(http, "<client-id>", "<client-secret>");

// 1. Send the user here. WHOOP requires a state value of at least eight characters.
var consentUrl = oauth.CreateAuthorizationUrl(
    new Uri("https://example.com/callback"),
    new[] { WhoopScopes.ReadProfile, WhoopScopes.ReadRecovery, WhoopScopes.Offline },
    state: Guid.NewGuid().ToString("N"));

// 2. Exchange the code from the redirect.
var token = await oauth.ExchangeAuthorizationCodeAsync(code, new Uri("https://example.com/callback"));

Keeping tokens fresh

RefreshingWhoopTokenProvider hands out the cached access token until it is about to expire, refreshes exactly once even under concurrency, and calls you back so you can persist the rotated refresh token — WHOOP invalidates the previous one on every refresh.

var tokens = new RefreshingWhoopTokenProvider(
    oauth,
    refreshToken: storedRefreshToken,
    initialToken: token,
    onTokenRefreshed: async (refreshed, ct) => await store.SaveAsync(refreshed.RefreshToken!, ct));

using var whoop = new WhoopClient(new WhoopClientOptions { TokenProvider = tokens });

Trusted partners

using var tokenTransport = new HttpClient { BaseAddress = WhoopClientOptions.DefaultBaseAddress };
var partnerTokens = new PartnerWhoopTokenProvider(tokenTransport, "<client-id>", "<client-secret>");

using var whoop = new WhoopClient(new WhoopClientOptions { TokenProvider = partnerTokens });
var requisition = await whoop.Partner.GetLabRequisitionAsync(requisitionId);

Dependency injection

using Whoop.Sdk.Extensions.DependencyInjection;

builder.Services.AddWhoopAccessToken(token);           // or register your own IWhoopTokenProvider
builder.Services.AddWhoopClient()                      // typed HttpClient + auth handler
    .AddStandardResilienceHandler();                   // any IHttpClientBuilder extension works

For trusted partners, AddWhoopPartnerAuthentication registers a token provider that acquires tokens over a separate unauthenticated pipeline, so token acquisition cannot recurse through the auth handler.

Samples

Four runnable projects live in samples/ — see samples/README.md for how to run each.

Error handling

Every non-success response becomes a WhoopApiException carrying the status code, the raw body, and the request URI. HTTP 429 becomes a WhoopRateLimitExceededException exposing RetryAfter.

try
{
    var cycle = await whoop.Cycles.GetAsync(cycleId);
}
catch (WhoopRateLimitExceededException ex)
{
    await Task.Delay(ex.RetryAfter ?? TimeSpan.FromSeconds(30));
}
catch (WhoopApiException ex) when (ex.IsNotFound)
{
    // no such cycle
}

WHOOP's documented limits are 100 requests per minute and 10,000 per day per user. Combine AddWhoopClient() with Microsoft.Extensions.Http.Resilience if you want automatic retries.

Scores may be absent

Cycle, Sleep, Recovery and Workout all carry a ScoreState. Only ScoreState.Scored guarantees a populated Score; PendingScore means "retry later" and Unscorable means it will never arrive. Unrecognised future values deserialize to ScoreState.Unknown rather than throwing.

API coverage

Anything not wrapped yet is reachable through WhoopClient.Connection, which exposes the raw typed SendAsync used by every endpoint client.

Building

dotnet build Whoop.Sdk.slnx
dotnet test Whoop.Sdk.slnx
dotnet pack Whoop.Sdk.slnx -c Release   # packages land in artifacts/packages

The vendored copy of the spec this client was written against lives in assets/whoop-openapi.json.

License

MIT. Not affiliated with or endorsed by WHOOP, Inc.