Whop credentials come from server environment variables (WHOP_API_KEY, WHOP_COMPANY_ID) — set those in Vercel, never in the browser. Totals company payments Whop ties to the selected affiliate, with paid_at in your UTC range: creator total (usd_total / total) minus refunded_amount — not affiliate commissions. Attribution order per payment: payment affiliate field → checkout session affiliate / affiliate_code (plus membership checkout id for renewals) → promo fallback.
Vercel → Project → Settings → Environment Variables
Redeploy after saving. Use .env.local with the same names for local dev.