Hosted Offer Page (No SDK)

const ENCORE_PUBLISHABLE_KEY = 'pk_live_yourpublishablekey';   // publishable, not a secret

const attributes = {
  countryCode: user.countryCode,
  subscriptionTier: user.tier,
  monthsSubscribed: String(user.monthsSubscribed),
  custom: { machine: String(machine.id) },   // custom values must be strings
};

// A store failure must never stop the page opening, and it takes both branches to
// guarantee that: a non-2xx RESOLVES and is caught by `ok`, while offline, DNS failure,
// a timeout and a blocked preflight all REJECT.
try {
  const res = await fetch('https://api.encorekit.com/encore/publisher/sdk/v1/users/attributes', {
    method: 'POST',
    headers: {
      'X-API-Key': ENCORE_PUBLISHABLE_KEY,
      'X-Platform': 'web',                 // multi-app projects only
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ userId: user.id, attributes }),
  });
  if (!res.ok) {
    // 4xx: a refused key, a malformed request, or an age outside 0-120. Retrying will not
    // help. 5xx: transient, worth a retry with backoff.
    console.warn('Encore attributes not stored:', res.status, await res.text());
  }
} catch (err) {
  console.warn('Encore attributes not stored:', err);
}

const ENCORE_PUBLISHABLE_KEY = 'pk_live_yourpublishablekey';

const url = new URL('https://www.encorekit.com/offers');
url.searchParams.set('apiKey', ENCORE_PUBLISHABLE_KEY);
url.searchParams.set('userId', user.id);                  // your stable id
url.searchParams.set('placement', 'vending_kiosk');

openWebView(url.toString());

import crypto from 'node:crypto';

const method = 'GET';
const path = '/publisher/sdk/v1/entitlements/server';   // the signed path: no /encore
const query = `userId=${encodeURIComponent(userId)}`;   // the same id the webview URL carried

const timestamp = Math.floor(Date.now() / 1000).toString();
const signature = crypto
  .createHmac('sha256', process.env.ENCORE_SECRET_KEY)
  .update(`${timestamp}.${method}.${path}.${query}`)
  .digest('hex');

const res = await fetch(`https://api.encorekit.com/encore${path}?${query}`, {
  method,
  headers: {
    'X-API-Key': process.env.ENCORE_PUBLISHABLE_KEY,   // pk_live_...
    'X-Signature': signature,
    'X-Timestamp': timestamp,
  },
});

if (!res.ok) return;   // 401 = bad signature, stale timestamp, or an unresolvable key

const { verified } = await res.json();
const entitled =
  Boolean(verified.freeTrial) ||
  Boolean(verified.credits?.totalAmount) ||
  (verified.discounts?.length ?? 0) > 0;

if (entitled) grantAccess(userId);