Payments (Waffo Pancake)

This marketing site sells one-time commercial licenses through Waffo Pancake using @waffo/pancake-ts.

What is wired up

Piece	Path
Checkout session API	POST /api/checkout → functions/api/checkout.ts
Webhook receiver	POST /api/webhooks/waffo → functions/api/webhooks/waffo.ts
License lookup	POST /api/licenses/lookup → functions/api/licenses/lookup.ts
Pricing CTAs	Currently link to Contact (checkout UI not mounted)
Thanks / redeem	/thanks and /zh/thanks
Agent skill	.agents/skills/waffo-pancake/SKILL.md

Checkout opens in a new tab (window.open) per Waffo guidance. Webhooks verify RSA signatures with verifyWebhook(rawBody, signature) — the body must be raw text.

Environment variables

Set in .env (local) and Cloudflare Pages secrets (production):

WAFFO_MERCHANT_ID=
WAFFO_PRIVATE_KEY=          # or WAFFO_PRIVATE_KEY_BASE64=
WAFFO_PRODUCT_STANDARD=     # one-time Product ID (Standard $199)
WAFFO_PRODUCT_PRO=          # one-time Product ID (Pro $299)
WAFFO_STORE_ID=             # optional; used by seed script
WAFFO_WEBHOOK_ENVIRONMENT=test   # or prod
SITE_URL=https://your-domain.com

Also bind a KV namespace as LICENSES (see wrangler.jsonc) so order.completed events persist for lookup.

Create products

1. Sign in to the Waffo Dashboard.
2. Create (or select) a store.
3. Create two one-time products (digital_goods / software), e.g. $199 and $299 USD.
4. Copy Product IDs into WAFFO_PRODUCT_STANDARD / WAFFO_PRODUCT_PRO.
5. Or run pnpm run seed:waffo after setting merchant credentials.

Publish products before going live (.publish() or Dashboard Live mode).

Register the webhook

Point an HTTP webhook at:

https://your-domain.com/api/webhooks/waffo

Events: at least order.completed.

Locally use ngrok (not localtunnel) so X-Waffo-Signature is preserved:

ngrok http 4321

Test cards

Success: 4576 7500 0000 0110
Declined: 4576 7500 0000 0220

Any future expiry / CVC.

Fulfillment flow

1. Buyer clicks Buy → POST /api/checkout → Waffo hosted checkout.
2. After payment, Waffo redirects to /thanks (or /zh/thanks).
3. Webhook order.completed stores the purchase in KV keyed by email + order id.
4. Buyer can look up purchases on the thanks page; deliver source access (private repo invite / download) manually or via your email provider.