Hosted Offer Page (No SDK)

const url = new URL('https://www.encorekit.com/offers');
url.searchParams.set('apiKey', process.env.ENCORE_PUBLISHABLE_KEY);   // pk_live_...
url.searchParams.set('userId', user.id);                              // your stable id
url.searchParams.set('placement', 'vending_kiosk');
url.searchParams.set('countryCode', user.countryCode);
url.searchParams.set('custom.machine', machine.id);

openWebView(url.toString());

import crypto from 'node:crypto';

const method = 'GET';
const path = '/publisher/sdk/v1/entitlements/server';   // the signed path: no /encore
const query = `userId=${encodeURIComponent(userId)}`;   // the same id the webview URL carried

const timestamp = Math.floor(Date.now() / 1000).toString();
const signature = crypto
  .createHmac('sha256', process.env.ENCORE_SECRET_KEY)
  .update(`${timestamp}.${method}.${path}.${query}`)
  .digest('hex');

const res = await fetch(`https://api.encorekit.com/encore${path}?${query}`, {
  method,
  headers: {
    'X-API-Key': process.env.ENCORE_PUBLISHABLE_KEY,   // pk_live_...
    'X-Signature': signature,
    'X-Timestamp': timestamp,
  },
});

if (!res.ok) return;   // 401 = bad signature, stale timestamp, or an unresolvable key

const { verified } = await res.json();
const entitled =
  Boolean(verified.freeTrial) ||
  Boolean(verified.credits?.totalAmount) ||
  (verified.discounts?.length ?? 0) > 0;

if (entitled) grantAccess(userId);