# TCGPlaytest Partner API

> Server-side card manufacturing integration. Upload directly to TCGPlaytest storage or supply existing image URLs, poll validation, then use browser JavaScript TCGPlaytest.checkout(cart) for LIVE embedded checkout. PHP returns cart JSON to that browser code. TEST carts open checkout_url as a separate full-page simulator with no Stripe payment.

API base URL: https://partner.tcgplaytest.com
API path version: /v1. OpenAPI document revision is not a new API path version.

## Public MCP ordering (no customer account or API key)
- [MCP setup and card previews](https://partner.tcgplaytest.com/docs/mcp).
- Current remote MCP URL: https://www.tcgplaytest.com/api/mcp on the commerce website, not the partner API origin. Use this exact URL without redirects. Production endpoint. Transport: Streamable HTTP. Authentication: none. Do not ask the customer to apply for a partnership, create an API key or supply the operator's secrets.
- Platform setup: [ChatGPT](https://partner.tcgplaytest.com/docs/mcp#mcp--chatgpt), [Claude](https://partner.tcgplaytest.com/docs/mcp#mcp--claude), [Gemini](https://partner.tcgplaytest.com/docs/mcp#mcp--gemini), [Codex](https://partner.tcgplaytest.com/docs/mcp#mcp--codex), [Claude Code](https://partner.tcgplaytest.com/docs/mcp#mcp--claude-code), [Gemini CLI](https://partner.tcgplaytest.com/docs/mcp#mcp--gemini-cli), [Cursor](https://partner.tcgplaytest.com/docs/mcp#mcp--cursor), [OpenAI Responses API](https://partner.tcgplaytest.com/docs/mcp#mcp--openai-api). Provider accounts, availability and usage charges still apply; steps and official references are in the guide.
- Verify a new connection by requesting printing options and a 2-card US quote before preparing an order. A chat attachment is not automatically uploaded to MCP: the client must PUT the file bytes or supply a direct HTTPS image URL.
- MCP-only pricing (mcp-base-per-card-v3): $34.95 covers cards 1-18; cards 19-180 add $0.35 each, 181-504 add $0.30 each, and 505 onward add $0.26 each, including above 1,008. Maximum 10,080 cards (560 sheets) per MCP order, no markup and no rounding later quantities to full sheets for billing. Sheets have 18 physical positions; only requested copies print.
- MCP-only shipping by quantity (US/Canada/other supported destinations): 1-100: $6.95/$18.95/$24.95; 101-250: $8.95/$24.95/$29.95; 251-500: $12.95/$32.95/$42.95; 501-792: $18.95/$44.95/$54.95; 793-1008: $18.95/$44.95/$64.95; 1009-3024: $18.95/$44.95/$104.95; 3025-5040: $26.95/$74.95/$184.95; 5041-7560: $39.95/$109.95/$274.95; 7561-10080: $52.95/$149.95/$364.95. Ordinary website/API/widget shipping is unchanged. 1-18 cards cost $41.90 with US shipping before tax.
- Show savings_message and extra_cards_at_same_total_before_tax. One-card message: "You can still order 17 more cards for no extra charge!" Free capacity ends at 18. Never add copies without customer agreement. Changed quantities need a fresh preparation and quote.
- Discounts cannot reduce card charges below $34.95; shipping is separate. Website/API/widget/prepaid/Connect pricing is separate. Interactive calculator: https://partner.tcgplaytest.com/docs/mcp#mcp--pricing. A numeric input accepts quantities beyond the slider's initial range.
- Cards will be delivered cut to standard trading card size with rounded corners
- Price is set based on demand, shipping rates, and material availability/cost
- Tools: get_card_printing_options; quote_card_order({quantity,country}); create_card_artwork_upload({content_type,size}); prepare_card_order({request_id,items:[{image_url,back_image_url?,quantity}]}); get_card_order_preparation({preparation_token}).
- Use actual full-quality public HTTPS PNG/JPEG artwork URLs, or first PUT bytes to the upload tool's returned upload_url using its headers, then use image_url. Never send a webpage URL or payment details. Omitted backs use the standard TCGPlaytest back.
- Maximum 10,080 cards / 560 sheets per MCP order (max_cards: 10080); request/upload/artwork quotas and numeric/payment constraints still apply; standard stock/finish, finished size 63 x 88 mm. Each image is single-frame PNG/JPEG, at most 20 MiB and 40 million pixels.
- Generate a fresh random UUID request_id per new preparation; keep it private and reuse it with identical inputs on retries. Poll with preparation_token at least five seconds apart; honor Retry-After/retry_after_seconds.
- Only status open returns preview_url and checkout_url. Give preview_url to the customer first: it shows paired fronts/backs, quantities and low-resolution warnings, six designs per page. It needs no login. Continue to checkout opens the returned checkout URL.
- Customers enter delivery details, confirm image rights and review the final price before paying. The tools cannot charge, spend partner printing credit, trigger printing without successful payment, read admin/customer records or earn partner Connect payouts.
- Image links last up to 15 minutes, bounded by cart expiry. Reload previews refreshes them while the cart is open. The validated full-quality files remain the print source. Trim previews approximate the finished cut; final cutting/colors may vary.
- Keep preparation/upload/preview/checkout capabilities private: anyone holding a preview link can see that cart's artwork. The site operator's partner key/signing secret are never shared with MCP customers.
- HTTP GET in a browser returns 405 for the tool endpoint. 503 means disabled, unconfigured or unavailable; a customer key will not fix it. Browser MCP clients on another website may need that exact Origin allowed; server/desktop clients without Origin need no setting.
- The REST API account/key requirements below apply to partner integrations, not public MCP guest ordering.

## Partner REST API

## Prepaid fulfillment (optional server API, test and live)
- Automatic hosted API and widget checkout: keep the existing server API key and ordinary POST /v1/carts → poll → checkout_url integration. Omit settlement (defaults to hosted). With prepaid enabled, current prepaid terms accepted and enough available credit, the platform spends printing credit and collects only shipping plus fulfillment tax from the customer. Otherwise it charges the full normal customer checkout. No partial credit use and no partner-side prepaid calls required. The funding decision is fixed before payment creation; retries cannot switch paths or charge twice. Payment setup errors after selection require retry, never silent full-price fallback. Live-mode standalone widget carts use the same credit selection for their own partner. No secret API key or snippet change is required. Test-mode widget previews never spend credit. Both funded and full-payment paths automatically redirect to the validated return_url after verified payment/order; the partner success page still verifies its saved cart and order.
- Mode is detected automatically from STRIPE_SECRET_KEY: sk_test_/rk_test_ selects test, live credentials select live. No additional mode variable or separate test tables. Use the same tcgp_live_ partner API key with either Stripe credential set. Terms are accepted once per version for both. Both platform apps must use the same Stripe account/environment, matching webhook signing secrets and live Stripe Tax configuration. With the current commerce quote handler, test prepaid quotes return zero tax without calling Stripe Tax; live quotes still require Tax setup and fail closed on errors. One mode per deployment; finish pending checkouts before switching credentials and redeploy. Use separate deployments for concurrent testing/live traffic. Test balances never become live funds.
- Test quotes, balances and order reads include mode:test and simulated:true. Paid test shipping checkout creates only a simulated order and an order.paid event on the Test webhook with data.simulated:true. Never prints or ships; no production/shipment events. Hosted test checkout/widget remains a non-paying preview.
- Partner dashboard: accept prepaid terms and buy USD credit using Stripe. Balance changes only after signed/verified payment reconciliation; browser return never credits money. Top-up $10–$5,000; processing fees are absorbed by the platform in this version.
- Optional advanced flow only: existing keys remain valid. Use settlement:"prepaid" in POST /v1/carts to explicitly quote/reserve/submit instead of using automatic hosted checkout. Test keys can spend isolated test credit on a deployment using Stripe test credentials. They never create production orders. Settlement cannot change on a cart.
- Poll artwork to open. Prepaid carts omit checkout_url. POST /v1/prepaid/quotes {cart_id,shipping:{name,email,line1,line2?,city,state?,postal_code,country,phone?}} with a stable Idempotency-Key. Costs are current printing/shipping rates and Stripe Tax, in integer USD cents, without coupons/affiliate rewards. Keep the quote private from the shopper if exposing only retail prices.
- New quotes use funding_model:cards_credit: credit_cents equals printing_cents; customer_payment_cents equals shipping_cents + tax_cents. Legacy funded quotes retain credit_all. Customer tax is the quoted fulfillment tax on printing/shipping, not a calculation of the partner's retail markup/tax obligations. Do not charge shipping/quoted tax in your own checkout as well.
- POST /v1/prepaid/quotes/{id}/reserve (no body) before charging the customer for cards. Reserves printing cost only. Quote/reservation expires at expires_at (up to 30 minutes); retries do not extend it. Submission needs more than 65 minutes of cart life remaining. 402 insufficient_credit means do not charge your customer.
- Collect the current exact rights statement and quality acknowledgment, customer email and actual accepted_at on/after cart creation. Persist body/key. Confirm your own card-sale payment server-side, then POST /v1/prepaid/orders {quote_id,acceptance:{accepted:true,terms_version:"2026-10-04-v2",email,accepted_at,image_quality_accepted?}}. This debits only printing once, returns 202 with checkout_url, order_id:null, quote and status_url. Redirect the customer to returned Stripe checkout to pay shipping + fulfillment tax directly to TCGPlaytest. Never regenerate acceptance/key on retry. Manufacturing starts only after verified customer payment. Browser return is not proof.
- GET /v1/prepaid/quotes/{id} reads persisted payment state; poll through your server every 5 seconds or slower, honor rate limits. customer_payment_status pending/open: wait or resume the same checkout_url; paid + order_id: manufacturing funded; expired: printing credit returned, start a NEW cart or refund your retail card charge; review/refund_pending/refunded: stop and contact support. Only unused pre-submission holds can be released. Checkout lasts one hour after submission; only Stripe-confirmed unpaid expiry returns printing credit. An unknown checkout-create response is retried with the original parameters and must be reviewed by support if unresolved past the idempotency window.
- GET /v1/prepaid/balance returns balance_cents, available_cents, reserved_cents, spending_blocked and ledger (50 entries; next_before cursor). Payment refunds/disputes can create negative balances and block spending.
- Track manufacturing via GET /v1/orders/{id} and signed order.* events. order.paid for split funding means printing credit AND customer shipping/tax payment are confirmed; it does not verify your separate retail card payment. After approved cancellation, admin refund returns only printing credit and queues the customer's shipping/tax Stripe refund plus tax reversal. Legacy orders retain full-credit refunds. Refunds/disputes put unshipped production on hold; partial customer refunds require operator review and tax reconciliation. The partner refunds its own card-sale charge separately. No partial credit refund/cash withdrawal API.

- Rate limits: ALL /v1/prepaid endpoints share the 60 requests per API key per minute allowance with upload-grant POSTs, cart POSTs and order GETs. This includes quote creation, quote GET polling, reserve, release, prepaid order submission, balance/ledger reads and retries. Quote polling is NOT exempt; only authenticated cart-status GETs are exempt. Poll quotes every five seconds or slower, budget across concurrent orders, and honor Retry-After on HTTP 429. Preserve the original body and idempotency key when retrying mutations.

## Stripe Connect payouts
Optional US partner server API flow. Complete Dashboard /dashboard/connect onboarding and terms. POST /v1/carts with settlement:"connect" and retail_amount_cents (whole card-sale subtotal, USD cents, 50–5000000, excluding shipping/tax, at least printing cost). Use the existing live partner key; Stripe credentials select payment environment. Upload/poll/embed/return as usual. Connect never spends prepaid credit, and cannot accept affiliate discounts. The standalone widget retains automatic credit-or-normal checkout; Connect retail pricing needs the server API.
Earnings = retail subtotal minus printing cost minus actual Stripe processing fee. Transfer 95% after verified payment; reserve 5% rounded up a cent for 15 days, then automatic eligible release to the connected Stripe balance. Bank arrival follows Stripe. Refunds reduce earnings and recover excess transfers. Disputes/restrictions/recovery pause transfers. Test Connect payments do not manufacture. Operator setup: same Stripe account on both apps, PARTNER_CONNECT_ENABLED=true, new Connect SQL, platform /api/stripe/connect/webhook with STRIPE_CONNECT_WEBHOOK_SECRET, existing commerce webhook and every-minute connect-maintenance cron. Retain enough platform balance for reserves. See /docs/connect.


## Start here
- [Developer documentation](https://partner.tcgplaytest.com/docs): server-rendered topic pages covering setup, exact fields, limits, examples, errors, widget, webhooks and content obligations. Each topic has its own URL and readable HTML.
- [First order in 10 minutes](https://partner.tcgplaytest.com/docs/first-order): runnable test-key-to-verified-webhook example, including actual delivery, retry, signature and duplicate checks.
- [Going live](https://partner.tcgplaytest.com/docs/go-live): partner launch checklist. Platform flags, migrations and Stripe setup are in the internal engineering operations guide, not the partner checklist.
- [OpenAPI 3.1 schema](https://partner.tcgplaytest.com/openapi.json): requests, responses, security and webhook payloads.
- [Partner dashboard](https://partner.tcgplaytest.com/dashboard): a human signs in with Google, completes the application, accepts the current partner terms and creates test/live keys. The human also configures the webhook URL and saves its displayed signing secret.
- [Partner terms](https://partner.tcgplaytest.com/terms): do not knowingly send unlawful/infringing content; remove and stop forwarding notified content; cooperate on complaints; orders may be refused, held or cancelled and repeat offenders suspended.

## Support
- [Integration and order support](https://www.tcgplaytest.com/support) or email support@tcgplaytest.com. Include the endpoint, error code and cart/order reference; never send API keys, signing secrets or private artwork URLs.

## Contract
- [Checkout branding](https://partner.tcgplaytest.com/docs/branding): saved in Dashboard > 4. Checkout branding, not cart request fields. Logo PNG/JPEG up to 200 KiB, name, accent, theme, preset font/layout/heading, plain-text welcome. Required warnings/acknowledgments, rights, fields, pricing, seller disclosure and payment are platform-controlled. No HTML/CSS/scripts or external logos. Both API and widget hosted checkout use the account settings; the widget modal and payment-provider pages are unchanged. Hosted test carts remain non-paying; dashboard provides a style preview.
- [Embedded checkout](https://partner.tcgplaytest.com/docs/embedded-checkout): default widget behavior keeps delivery details, account branding and rights confirmation on the partner page. Server API clients replace their checkout_url redirect with TCGPlaytest.checkout(openCart) after loading the script with data-auto-button="false" and data-checkout-origin. Exact registered website and additional widget origins may frame checkout; return_url still requires the registered website origin. Only Stripe payment navigates away, then verified return goes to the partner success page. data-checkout-display="redirect" opts into a full-page handoff. No new key, SQL or environment setting.
- [Success pages](https://partner.tcgplaytest.com/docs/success-page): return_url must use the exact HTTPS origin in the partner website_url. Additional widget origins do not authorize API return destinations. STORE_ORIGIN belongs to the partner application, not the API; update it and redeploy separately when changing website_url. Localhost HTTP cannot receive the payment return. Save cart ownership and verify order payment; return navigation alone is not proof.
- [Language examples](https://partner.tcgplaytest.com/docs/language-examples): cURL/Bash with jq (including direct upload), Python 3 requests, PHP 8 cURL and Node.js. Keys only on server; preserve payload/idempotency on retries; scope reads to the owning customer; honor Retry-After.
- Authorization: Bearer <server-side partner API key>. Never put the key in browser/widget code.
- Auto-bleed is API-managed before a cart becomes open: 2 mm on a 63 x 88 mm finished card, using the website mask/corner rules. Partners submit finished artwork without implementing bleed. Recognized existing 2 mm bleed is preserved; 3 mm is cropped to 2 mm. Example: 1500x2100 becomes 1596x2196. Optional SHA-256 checks the original source, not the prepared file. Dashboard/production use prepared files. Both original and prepared files are private, cart-scoped, and share expiry/retention/holds. Source and prepared files each must fit 20 MiB and 40 MP. Existing orders are not retroactively processed.
- Optional POST /v1/uploads with {content_type: "image/png" or "image/jpeg", size: file byte count} returns 201 {upload_url, method: "PUT", headers: {"Content-Type": ...}, image_url, upload_expires_at, expires_at, max_bytes: 20971520}. No partner Blob/Supabase account or hosting is needed. PUT raw bytes to upload_url with only the returned headers, no API key/cookies. Upload link lasts 2 hours and cannot overwrite. After successful PUT, use image_url unchanged in the existing cart fields; no finalize call. Upload authorization uses the shared write rate limit; honor Retry-After. A failed/uncertain PUT can be retried with a fresh grant. The cart worker still performs all validation.
- image_url is a private signed capability, scoped to the partner and key mode and valid for 8 days; do not log/share it. Create the cart promptly. Issuing key revocation disables source access. Source staging files are removed by maintenance after expiry (normally within the following day). Validated cart files follow the retention rules below. Test keys support uploads; hosted/Connect test keys use a payment-free order simulator; prepaid sandbox keeps its separate Stripe test payment flow.
- POST /v1/carts requires Idempotency-Key: 1–200 visible ASCII characters, no spaces. Body: items with image_url, quantity and optional item/shared back_image_url (omitting both backs selects the TCGPlaytest default); optional hashes, external_ref, return_url, standard card_stock and settlement (hosted by default, or prepaid for enabled live accounts).
- Do not send certification, affiliate_code or partner-terms fields. retail_amount_cents is accepted only with settlement:connect. Terms version and saved affiliate preference are copied by the server. The customer certifies image rights at checkout; the partner still has the obligations above.
- New POST returns 202, status validating, no checkout_url. GET /v1/carts/{id} every 3–5 seconds; honor Retry-After. Polling is authenticated but exempt from the 60/minute/key shared upload, cart, order and prepaid limit.
- For an open hosted cart, pass the cart to TCGPlaytest.checkout(cart) to stay on the partner page. A full-page handoff can instead use checkout_url verbatim. Prepaid carts never expose checkout_url: after open, quote, reserve credit and submit through the prepaid endpoints below. For failed, inspect every errors entry (item_index is zero-based; side, code, message), fix inputs and create a new cart with a new Idempotency-Key. Do not rotate the API key. Other terminal states: converted, expired, blocked, cancelled. A converted prepaid cart confirms fulfillment funding, not the shopper's separate payment to your store.
- Maximum 1000 items AND 1000 total quantity; JSON body ≤512,000 bytes; external_ref ≤200 UTF-16 code units; HTTPS URLs ≤2048 UTF-16 code units.
- Artwork: public IPv4 HTTPS, PNG/JPEG single frame, ≤20 MiB, ≤40,000,000 pixels, recommended 744×1040. Smaller readable files are accepted with warnings (code image_low_resolution, item_index, side, source width/height and recommended_width/recommended_height). Hosted checkout allows ordering after acknowledging the warning. At most 3 redirects. Total download deadline 15 seconds per URL attempt, including DNS/TLS/redirects/body. Private/local addresses are blocked.
- Optional SHA-256 is 64 hex characters over exact file bytes; a mismatch fails that item/side. Each URL is checked within its cart; validated files are never reused across carts. No source downloads after payment. Existing public HTTPS URL integrations continue to work; direct uploads are optional. There is no finalize endpoint.
- Current deployment: cart lifetime 168 hours from creation; retention 30 days after shipment/cancellation, subject to reconciliation and legal holds. expires_at is authoritative; all timestamp strings use RFC 3339 with timezone.
- GET /v1/orders/{id} uses cart.order_id or an order webhook data.id. It returns id, cart_id, status, shipment, created_at, updated_at, external_ref and card_count. Browser return is not proof of payment.
- Webhooks: order.paid, order.in_production, order.shipped, order.cancelled, cart.expired. Envelope: id, type, created_at, data. Deduplicate by top-level id. Verify TCGP-Signature (t=Unix seconds,v1=hex HMAC-SHA256) over timestamp + "." + exact raw body, with the signing secret, constant-time comparison and ±300-second tolerance. Respond 2xx after durable receipt. Up to 12 attempts; no delivery-order guarantee.
- Webhook endpoints must share the registered website origin. Test/live settings and secrets are separate; saving rotates the secret. Test hosted/Connect carts support simulated order.paid, order.in_production, order.shipped and order.cancelled through /v1/test endpoints. Their data.mode is test and data.simulated is true. Prepaid retains its separate sandbox flow. All simulation events use the Test webhook secret and delivery queue.
- GET /v1/estimate?quantity=10 is public, no API key. Returns currency USD, quantity, unit_amount and subtotal_amount (integer cents), excludes shipping/tax/discounts. Final price is recalculated at checkout. Estimate failures do not block checkout.
## Checkout simulator (hosted and Connect)
- Guide: https://partner.tcgplaytest.com/docs/sandbox. Use a tcgp_test_ key; no Stripe account or payment credentials required. Create and validate an ordinary hosted cart or a Connect cart with settlement:connect and retail_amount_cents, then open checkout_url. The widget test mode opens a full-page simulator.
- Complete in the browser, or POST /v1/test/carts/{id}/complete with {confirm_simulation:true}. Returns an Order with test_order_ ID, mode:test, simulated:true, settlement, card_count and items:[{item_index,quantity}]. Completion is atomic and idempotent by cart. It changes the cart to converted and queues order.paid on the Test webhook.
- POST /v1/test/orders/{id}/events with {status:in_production}, then {status:shipped}; cancelled is allowed before shipment. Idempotent by order/status: replays return current state and do not emit another event. Invalid transitions 409, expired unpaid cart 410, live key 403, foreign cart/order 404. The shared API rate limit applies. No Idempotency-Key is required for these two endpoints.
- Simulated shipment includes a dummy carrier/tracking link. No manufacturing, Stripe charge, transfer or credit debit happens. Test receipt does not validate prices, discounts, tax, fees, payouts or real shipping; test those separately with Stripe test credentials. Dummy browser delivery fields are not saved. Existing prepaid sandbox is separate.
- Return navigation appends cart_id, order_id, mode=test, simulated=true to the saved URL on the registered website origin. Do not trust these parameters. Authenticate the customer, load their saved checkout revision, read its cart and cart.order_id with the test key and verify mode, simulated:true, IDs, external_ref, item quantities and status paid/in_production/shipped. Clear only that frozen revision once, preserving later additions. Never clear a live cart on a simulated event.
- Test events use the existing Test webhook setting/secret and maintenance worker. Delivery is asynchronous, retried, and may be out of order. Mark queued versus delivered accurately. Never accept simulated:true as real payment.
## Standalone widget (no partner secret API key or partner storage)
- Copy the personalized script from the dashboard after accepting terms. data-partner-key is the public widget_partner_key, not an API secret. data-mode is test (simulated checkout) or live. Register each exact HTTPS website origin in the dashboard.
- Optional configure fields: returnUrl (same registered website origin), externalRef (saved checkout revision), onCartReady: async cart => {...} (bind to authenticated customer on your server; awaited before opening, idempotent on retries). Public codes do not authenticate customers.
- After script load call TCGPlaytest.configure({getItems: async () => [{front: finishedPngBlob, back: backFile, quantity: 1}]}). Front/back can also be async Blob factories. The default button handles uploads, validation progress and embedded checkout on the partner page. For a custom button use data-auto-button="false" and TCGPlaytest.open().
- Item back takes priority over sharedBack; omit both to use the centrally hosted TCGPlaytest default. A double-sided card must supply its matching back. The modal renders up to three previews at once, shows low-resolution warnings, and fetches a print estimate immediately. TCGPlaytest.estimate(quantity) exposes that estimate for editor UI. No upload is needed for the default back.
- The branded widget owns an optional "Print both faces separately" action for a supplied front/back pair. The customer chooses it in the modal; partners do not add code or configuration. Both resulting cards use sharedBack or the TCGPlaytest default, preserving each face's original quantity. Previews, physical-card count and price estimate update before checkout. "Print front and back together" reverses the choice. Custom backs are never split automatically. Layout cannot change during upload/cart retries; "Use current designs" starts a new order. Headless calls preserve supplied pairs.
- Call TCGPlaytest.reset() after editing a previously submitted deck. Network retries and same-tab reloads resume the same submitted cart. The public-code widget does not call a partner-owned cart endpoint.
- POST /api/widget/sessions with {partner_key,mode} returns {token,expires_at,mode,max_cards,max_image_bytes}. Session lives one hour, is scoped to a partner, origin and mode, and can create only one cart.
- With Authorization: Bearer <session token>, POST /api/widget/uploads with {request_id: UUID,content_type,size} returns {id,upload_url,method,headers,max_bytes,upload_expires_at}. PUT bytes directly to the returned URL without Authorization/cookies. Storage grants last two hours and cannot overwrite.
- POST /api/widget/cart with {items:[{front_upload_id,back_upload_id?,quantity}],external_ref?,return_url?}; only session-owned uploads accepted. GET /api/widget/cart polls that same cart. Both return the documented Cart shape. Use Origin and the session token on these calls, never a secret API key.
- Configured widget quotas: 60 sessions/partner/hour, 2000 upload grants/session, 10000 grants/partner/rolling 24 hours. Defaults are 60, 2,000 and 10,000 respectively; operator environment overrides apply. These quotas are separate from the API-key rate limit. Each front/back upload consumes a grant reserving up to 20 MiB; copies can reuse an uploaded image. Identical request_id retries reuse the grant. Widget cart GET is exempt from session/upload quotas. Honor Retry-After on 429.
- Partner terms, affiliate setting, order ownership and analytics are assigned server-side. Public codes and Origin checks alone do not authenticate non-browser callers; expiring sessions, quotas and ownership checks limit public upload access.