Whoop Digest

Overview

Whoop Digest is a single Cloudflare Worker that anyone can sign up to. Connect your Whoop account, pair your Telegram chat with a six-digit code, and every morning, shortly after you wake, a structured digest arrives: time in bed and asleep, efficiency, sleep stages, disturbances, respiratory rate, sleep debt, recovery score with HRV, resting heart rate, SpO2 and skin temperature, and yesterday's strain, calories and heart rate. Typing /metrics to the bot sends it on demand.

Problem

Whoop collects the numbers I care about most and buries them behind taps in its app. I wanted them pushed to the place I already read first thing, and once it worked, friends wanted the same without me running a copy for each of them.

Approach

- Webhook-driven, not scheduled: Whoop's sleep.updated v2 webhook fires when last night's sleep is scored. The Worker verifies the HMAC signature, looks up which user it belongs to, fetches sleep, recovery and cycle for that user and sends their digest
- Two-step self-onboarding: /auth starts the Whoop OAuth flow; /callback stores the tokens by Whoop user ID and mints a six-digit pairing code; the user DMs the code to the bot, which binds the Telegram chat to the Whoop user
- State in KV only: tokens that auto-refresh, the chat binding, a reverse lookup from chat to user, the last sleep ID sent (for dedupe), pairing codes with a ten-minute TTL, and CSRF state for OAuth. No database
- Verified inbound: the Whoop webhook is checked against its HMAC, the Telegram webhook against a secret token

Key Decisions

- One Worker for everyone: multi-tenant from the start, keyed by Whoop user ID, so adding a friend is a link rather than a deploy.
- Dedupe by sleep ID: Whoop can re-fire updates for the same night. Storing the last sent sleep ID per user keeps the digest to one message.

Outcome

Live and used daily. Friends onboard themselves at whoop-digest.xaid.workers.dev.