Settings
Three independent pieces: Google says who you are, the WHOOP API supplies everything historical, and a Bluetooth broadcast carries live heart rate. Each works without the others.
OAuth 2.0 with the offline scope, so the link survives past the first hour.
Done: DATABASE_URL configured
Postgres holds your synced history. Without it the dashboard runs on demo data.
Done: Supabase configured
Supabase Auth provides Google sign-in and carries the live heart-rate stream.
Done: WHOOP OAuth credentials configured
Create an app at developer-dashboard.whoop.com and set the client id, secret and redirect URI.
Independent of the API — this path is pure Bluetooth.
WHOOP exposes the standard Bluetooth Heart Rate Service when you enable Heart Rate Broadcast in the app. Chrome and Edge on macOS can read it directly from this page. Safari cannot — not on macOS and not on iOS — so your iPhone subscribes to the Mac's stream instead of connecting itself.
Without Supabase Realtime credentials the stream stays inside one browser. With them, it reaches any device you have the dashboard open on.
Open the live view →Three mechanisms, deliberately overlapping.
Sign-in says who you are; WHOOP supplies the data. Unlinking one leaves the other.
Not signed in. Sign in
Not done: Account linked
Not linked yet — the dashboard is showing generated data.