Rules for your integration

Every integration, and the AI coding assistant building it, must follow these rules.

1. All calls MUST be made from your backend server. Never put your API key in browser JavaScript, a mobile app, or a public repository.
2. Never construct the checkout URL yourself. Always use the buyLink string from the most recent cart response, verbatim. This holds with or without CJ.
3. Money is always an integer in minor units (cents for USD). See Conventions.
4. Treat cursor values as opaque. Send them back exactly as received, URL-encoded.
5. Send identical query parameters on every page of one products walk. Only cursor changes.
6. Read error codes with one helper. See Handling errors.
7. Do not blind-retry adding items to a cart. It adds quantity, so a retry can double it. On a timeout, read the cart and reconcile.
8. Only US inventory is exposed: every deal the API returns is a US deal. Always send country=US.
9. Send your own User-Agent header on every request, for example MyStore/1.0 (+https://mystore.example). A generic client default is rejected.
10. Never share an API key between storefronts. A key acts as the storefront that created it.
11. Revoke a key you no longer use, from the storefront's key list in this portal.