WaffarAD Affiliate Network

Affiliate tracking: Settings → WaffarAD Tracking → “Enable affiliate order tracking” (on by default).
In-App Order gateway: WooCommerce → Settings → Payments → In-App Order → Enable/Disable.
WaffarX Coupons: Settings → WaffarAD Tracking → “Enable WaffarX Coupons” (on by default).
WaffarX Platform API: Settings → WaffarAD Tracking → “Enable the WaffarX Platform API” (on by default). Turn this off if you do not want the catalog/cart/shipping/order-list/refund API exposed.
Each toggle notifies WaffarX.

Settings → WaffarAD Tracking → “WaffarX API Credentials”: a single API Key and API Secret, provided to you by WaffarX. This one pair powers everything — it identifies your store, signs outbound reporting, and authenticates every inbound WaffarX API call. Alternatively, define WAFFARAD_API_KEY and WAFFARAD_API_SECRET in wp-config.php; those constants take precedence. No WooCommerce REST consumer keys are needed. Inbound requests are not run as any WordPress user; the Platform API authorizes its internal WooCommerce calls only for the duration of each request.

With the single API Secret, either way:
* Bearer token: Authorization: Bearer
* HMAC signature: X-WaffarX-Key + X-WaffarX-Timestamp + X-WaffarX-Signature, where the signature is HMAC-SHA256 of “timestamp.rawBody” using the secret (a short timestamp window guards against replay).

WooCommerce → Settings → Payments → In-App Order: the allowed gateway values and allowed gateway statuses. (Authentication uses the unified WaffarX API Secret above — there is no separate gateway token.)

Base: https://your-domain.com/wp-json/waffarx/v1
* POST /order — place an order (requires gateway + transaction metadata; accepts optional affiliate attribution).
* GET /order/{id} — fetch an order.
* GET /order/by-idempotency-key?key=… — look up an order by idempotency key (full WooCommerce data).
* POST /order/{id}/cancel — cancel an order.
All require the unified WaffarX authentication (Bearer token = the API Secret, or an X-WaffarX HMAC signature).

Base: https://your-domain.com/wp-json/waffarx/v1 (all authenticated with the unified WaffarX credential; enabled via Settings → WaffarAD Tracking → “WaffarX Platform API”):
* GET /products, GET /products/{id}, GET /products/{id}/variations — catalog.
* GET /payment-gateways — available payment methods.
* GET /data/countries, GET /data/countries/{code} — countries and provinces.
* GET /shipping/zones, GET /shipping/zones/{id}/methods — shipping configuration.
* POST /shipping-rates — stateless shipping quote for given line_items + destination.
* GET /orders — list orders.
* POST /order/{id}/refund — refund an order (send api_refund=false for a manual/records-only refund).
* GET /cart, POST /cart/add-item, POST /cart/update-customer, POST /cart/select-shipping-rate — cart (Store API; pass the Cart-Token header returned by GET /cart).
These forward to WooCommerce’s own REST endpoints internally, so behavior and schemas match core WooCommerce.

Base: https://your-domain.com/wp-json/waffarx/v1
* POST /coupon — mint a single-use coupon. Body: amount (required), waffarx_reference (required object with voucher_id and optional batch_id/third_party_id/partner_id), and optional code, discount_type (default fixed_cart), expiry_date (YYYY-MM-DD), and individual_use (default false). If no code is supplied the plugin generates one and returns it. Minting is idempotent per voucher_id; a supplied code that already exists is rejected.
* GET /coupon/{code} — fetch a WaffarX-issued coupon.
* POST /coupon/{code}/void — disable an unused WaffarX-issued coupon.
The same authentication as the In-App Order API applies; mutating routes (create, void) require the feature to be enabled.