Whoop Cognito access token. Obtain via `totem auth` from the repo, which prompts for your Whoop email + password + SMS MFA code, then writes both tokens to a local .env. Auto-refreshes every ~24h. Secret.
WHOOP_COGNITO_REFRESH_TOKEN
Yes
Whoop Cognito refresh token (~30 day lifetime). Obtained alongside the bearer token from `totem auth`. When this expires, run `totem auth` to get a fresh pair. Secret.
WHOOP_EMAIL
Yes
Your Whoop account email. Used only by `totem auth` — the running server reads tokens, not credentials.
WHOOP_USER_ID
No
Your numeric Whoop user ID. Optional — used by whoop_profile and whoop_leaderboard. Avoids one redundant bootstrap call per session if set.
WHOOP_TIMEZONE
No
IANA timezone (e.g., America/Los_Angeles) for response timestamps. Optional — if unset, the server auto-detects from your Whoop profile's timezone_offset field (refreshed hourly).