> ## Documentation Index > Fetch the complete documentation index at: https://waffo.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Signed redirect to checkout > Hands an end user from the supplier's site to the Waffo Point Topup storefront. Waffo validates the required parameters, checks that `timestamp` is within 2 hours, recalculates the signature, issues a session token and then redirects the user to the `siteCode` purchase page. The signature must be generated on the supplier backend. Never expose `SECRET_KEY` to the front end. Signing string: drop `signature` and every parameter whose value is empty or blank, sort the remaining keys in ASCII ascending order, build `{baseUrl}?key1=value1&key2=value2&...` including the base URL, compute HMAC-SHA256 with the shared `SECRET_KEY`, hex-encode and uppercase. This endpoint is served from the dedicated `{supplier}.waffoplay.com` subdomain assigned during onboarding, not from the Waffo API host. A custom supplier-owned domain can be used instead — the supplier points that domain at the Waffo Point Topup endpoint, and the same domain must then be used as the base URL when building the signing string. ## OpenAPI ````yaml /api-reference/point-topup-api.json get /redirect openapi: 3.1.0 info: title: Waffo Point Topup description: >- Waffo-provided endpoints for the Waffo Point Topup supplier integration. Supplier-implemented endpoints (point code retrieval, direct fulfillment, fulfillment inquiry) are optional integrations and are documented in the Developer Docs instead, because their paths and contracts are defined by the supplier. termsOfService: https://www.waffo.com version: 1.5.1 servers: - url: https://api-sandbox.waffoplay.com description: Sandbox security: [] tags: - name: Point Topup redirect description: >- Signed redirect entry point that hands a supplier user over to the Waffo Point Topup storefront and checkout. - name: Point Topup fulfillment inquiry description: >- Pull-based lookup of a Mode C order's fulfillment result, used for reconciliation or when a webhook notification was missed. - name: Point Topup fulfillment webhook description: >- Final fulfillment result pushed from Waffo Point Topup to the supplier's notification endpoint. paths: /redirect: get: tags: - Point Topup redirect summary: Signed redirect to checkout description: >- Hands an end user from the supplier's site to the Waffo Point Topup storefront. Waffo validates the required parameters, checks that `timestamp` is within 2 hours, recalculates the signature, issues a session token and then redirects the user to the `siteCode` purchase page. The signature must be generated on the supplier backend. Never expose `SECRET_KEY` to the front end. Signing string: drop `signature` and every parameter whose value is empty or blank, sort the remaining keys in ASCII ascending order, build `{baseUrl}?key1=value1&key2=value2&...` including the base URL, compute HMAC-SHA256 with the shared `SECRET_KEY`, hex-encode and uppercase. This endpoint is served from the dedicated `{supplier}.waffoplay.com` subdomain assigned during onboarding, not from the Waffo API host. A custom supplier-owned domain can be used instead — the supplier points that domain at the Waffo Point Topup endpoint, and the same domain must then be used as the base URL when building the signing string. operationId: pointTopupRedirect parameters: - name: supplierId in: query description: >- Unique identifier assigned by Waffo to the supplier. Used to identify the supplier during API interactions. required: true schema: type: string maxLength: 64 example: WAFFO_POINT_TOPUP_001 - name: supplierUserAccount in: query description: Charge account, for example the supplier membership ID. required: true schema: type: string maxLength: 64 example: supplier_user_12345 - name: faceValue in: query description: Face value, for example the number of supplier credits. required: true schema: type: string maxLength: 32 example: '3000' - name: salesOrderId in: query description: >- Supplier's order ID. Waffo echoes it back on the fulfillment request, the fulfillment webhook and the fulfillment inquiry, so the supplier can reconcile against its own order record. required: true schema: type: string maxLength: 64 example: A123456 - name: siteCode in: query description: >- Target site code, ISO 3166-1 alpha-2 country code. For example `JP` for Japan or `US` for the United States. required: true schema: type: string maxLength: 2 minLength: 2 example: US - name: timestamp in: query description: >- Unix timestamp in milliseconds. Signature validity is controlled by this value; requests older than 2 hours are rejected. required: true schema: type: integer format: int64 example: 1713483091000 - name: signature in: query description: >- Uppercase hex HMAC-SHA256 signature over the signing string, used for parameter integrity verification. required: true schema: type: string maxLength: 64 example: ABC123XYZ456DEF789 - name: supplierUserEmail in: query description: >- Email address of the supplier member. Waffo Point Topup uses it to send the invoice to the user. required: false schema: type: string maxLength: 128 example: test@supplier.com - name: amount in: query description: >- Actual amount to be paid for the order. Precision must match the currency. Provide `amount` together with `currency` when the supplier sets the point price itself. required: false schema: type: string example: '3000' - name: currency in: query description: >- Order pricing currency, ISO 4217. Suppliers can price in a single currency; Waffo handles conversion between the pricing currency and the user's actual payment currency. required: false schema: type: string maxLength: 3 minLength: 3 example: JPY - name: returnUrl in: query description: >- Supplier front-end redirect URL that Waffo Point Topup returns the user to after checkout. Waffo appends `salesOrderId` to it. The value must be URL-encoded. required: false schema: type: string maxLength: 256 example: https%3A%2F%2Fexample.com%2Freturn_url_page%3FsalesOrderId%3DXXX - name: theme in: query description: Theme of the Waffo Point Topup checkout page. Defaults to `dark`. required: false schema: type: string maxLength: 16 enum: - light - dark example: light - name: productId in: query description: >- Product ID defined by Waffo and used by the supplier. When a supplier has multiple product types or multiple source websites, Waffo assigns one product ID per item so each can be mapped to its registered payment-channel configuration. The value must match an ID defined by Waffo. Required for multi-product suppliers, optional for single-product suppliers. required: false schema: type: string maxLength: 64 example: XX_POINT - name: notifyUrl in: query description: Endpoint that receives the fulfillment event webhook for this order. required: false schema: type: string maxLength: 512 example: https://example.com/pay/notify responses: '302': description: >- Signature verified. The user is redirected to the `siteCode` purchase page. On a missing parameter, an invalid signature or an expired timestamp, the user is redirected to the corresponding error or expiry page instead. headers: Location: description: Target page the user is redirected to. schema: type: string servers: - url: https://{supplier}.waffoplay.com description: >- Dedicated Waffo Point Topup subdomain assigned to each supplier. A custom supplier-owned domain can be used instead, as long as the supplier points that domain at the Waffo Point Topup endpoint. variables: supplier: default: '{supplier}' description: Subdomain assigned by Waffo during onboarding. ````