๐ฌPOS (trusted)Store-bound JWT, full redemption scope set. The till sells, redeems, and refunds without an HQ round-trip.Build a POS integration
๐eCom (untrusted)Internet-facing โ PIN required, no load, tighter buckets. Plan for the next request to be hostile.Build an eCom integration
๐ฅCRMSeparate plane for customer + card sync and bound-voucher lifecycle. A leaked CRM token cannot drain a voucher.Build a CRM integration
Small, stable contractFive public-plane endpoints โ token, check, load, redeem, refund โ cover every redemption integration.
Idempotent by constructionEvery mutating call carries Idempotency-Key โ a retry of the same key on the same voucher returns the original result and never acts twice.
Atomic, audited, hash-chainedEvery balance change is one transaction with a per-voucher ledger entry and a tamper-evident audit row. Double-spend-safe under concurrency.