Signed redirect to checkout

curl --request GET \
  --url https://{supplier}.waffoplay.com/redirect

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{supplier}.waffoplay.com/redirect",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{supplier}.waffoplay.com/redirect"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{supplier}.waffoplay.com/redirect")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

Point Topup

Signed redirect to checkout

Hands an end user from the supplier’s site to the Waffo Point Topup storefront. Waffo validates the required parameters, checks that timestamp is within 2 hours, recalculates the signature, issues a session token and then redirects the user to the siteCode purchase page.

The signature must be generated on the supplier backend. Never expose SECRET_KEY to the front end.

Signing string: drop signature and every parameter whose value is empty or blank, sort the remaining keys in ASCII ascending order, build {baseUrl}?key1=value1&key2=value2&... including the base URL, compute HMAC-SHA256 with the shared SECRET_KEY, hex-encode and uppercase.

This endpoint is served from the dedicated {supplier}.waffoplay.com subdomain assigned during onboarding, not from the Waffo API host. A custom supplier-owned domain can be used instead — the supplier points that domain at the Waffo Point Topup endpoint, and the same domain must then be used as the base URL when building the signing string.

GET

redirect

Signed redirect to checkout

curl --request GET \
  --url https://{supplier}.waffoplay.com/redirect

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{supplier}.waffoplay.com/redirect",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{supplier}.waffoplay.com/redirect"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{supplier}.waffoplay.com/redirect")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

Query Parameters

supplierId

string

required

Unique identifier assigned by Waffo to the supplier. Used to identify the supplier during API interactions.

Maximum string length: 64

supplierUserAccount

string

required

Charge account, for example the supplier membership ID.

Maximum string length: 64

faceValue

string

required

Face value, for example the number of supplier credits.

Maximum string length: 32

salesOrderId

string

required

Supplier's order ID. Waffo echoes it back on the fulfillment request, the fulfillment webhook and the fulfillment inquiry, so the supplier can reconcile against its own order record.

Maximum string length: 64

siteCode

string

required

Target site code, ISO 3166-1 alpha-2 country code. For example JP for Japan or US for the United States.

Required string length: 2

timestamp

integer<int64>

required

Unix timestamp in milliseconds. Signature validity is controlled by this value; requests older than 2 hours are rejected.

signature

string

required

Uppercase hex HMAC-SHA256 signature over the signing string, used for parameter integrity verification.

Maximum string length: 64

supplierUserEmail

string

Email address of the supplier member. Waffo Point Topup uses it to send the invoice to the user.

Maximum string length: 128

amount

string

Actual amount to be paid for the order. Precision must match the currency. Provide amount together with currency when the supplier sets the point price itself.

currency

string

Order pricing currency, ISO 4217. Suppliers can price in a single currency; Waffo handles conversion between the pricing currency and the user's actual payment currency.

Required string length: 3

returnUrl

string

Supplier front-end redirect URL that Waffo Point Topup returns the user to after checkout. Waffo appends salesOrderId to it. The value must be URL-encoded.

Maximum string length: 256

theme

enum<string>

Theme of the Waffo Point Topup checkout page. Defaults to dark.

Available options:

light,

dark

Maximum string length: 16

productId

string

Product ID defined by Waffo and used by the supplier. When a supplier has multiple product types or multiple source websites, Waffo assigns one product ID per item so each can be mapped to its registered payment-channel configuration. The value must match an ID defined by Waffo. Required for multi-product suppliers, optional for single-product suppliers.

Maximum string length: 64

notifyUrl

string

Endpoint that receives the fulfillment event webhook for this order.

Maximum string length: 512

Response

302

Signature verified. The user is redirected to the siteCode purchase page. On a missing parameter, an invalid signature or an expired timestamp, the user is redirected to the corresponding error or expiry page instead.

⌘I

Overview

One-time Payment

Subscription

Configuration

Chargeback

Tokenization

Payout

Point Topup

Signed redirect to checkout

Query Parameters

Response