Firmware version 50.43.x requires a WHOOP-signed entitlement token before the band releases any data #673

What happened?

My WHOOP app was still installed and silently pushed a firmware update to my WHOOP 5.0 (now 50.43.1.0). Since then OpenStrap edge receives no data at all, same as described above.

I captured the Bluetooth traffic (Android HCI snoop log) and found:

The band still connects and answers every command with status OK (HELLO, clock, GET_DATA_RANGE, battery, config reads), and it keeps recording to flash.
But after SEND_HISTORICAL_DATA (0x16) and TOGGLE_REALTIME_HR (0x03), nothing arrives on the data characteristic: no history, no live HR. This also happens with HELLO revision 3 and a fresh SET_CLOCK.
The official WHOOP app gets nothing either while there is no active membership, even after I started a trial.
After the trial was active (and a band reboot from the app), the WHOOP app wrote a signed token (JWT, ES256, issued by WHOOP's auth service and bound to this band) using opcodes 0x9b–0x9e. Immediately afterwards data started flowing.
With that token on the band, unmodified edge works again: history drained completely (gen5 v18 records, existing decoder), live HR matched my reference watch.
The token I received is valid for about 45 days. I don't know yet whether the band stops releasing data at the token's expiry or as soon as the membership ends. I'll report back.
So, as far as I can tell: on firmware 50.43.x, edge, NOOP and any other free app can only read data while a valid WHOOP membership token is on the band. It isn't a protocol or decoder problem that an app update could fix.

Recommendations

Remove or disable the WHOOP app if your band is still on an older firmware, because it can push the update without asking.
Maintainers: it might help to detect this state (commands answered OK but no data after 0x16/0x03) and show users a clear message instead of a silent sync failure.

Questions to the community

Does anyone know the first firmware version that needs the token? 50.38.1.0 apparently still worked without one.
Has anyone tested whether the band's standard Bluetooth heart-rate broadcast still works without an active membership? That would at least keep it usable as an HR strap.
Has anyone an older firmware or knows how to downgrade again?

Steps to reproduce

No response

App version

0.11.3

Platform

Android (APK)

Phone model and OS version

No response

Which band?

WHOOP 5.0 / MG (experimental — expect breakage)

Screenshots

No response

Quick checks

• The official WHOOP app is not also connected to this band
• I've searched existing issues for this