Class default

Trusted title server with commerce:fulfill or admin JWT acknowledges the immutable event.

Direct authorized archive. Never deletes financial history or bypasses the last-revenue-model rule.

Bind once to the existing authenticated account. Cannot reassign another player's purchase.

Guest catalog on the exact approved game Origin. Sandbox requires enabled sandbox settings; the backend enforces environment policy.

Bound-user JWT + session capability. Reuse the idempotency key after a network timeout.

Game exchanges a verified popup code. Browser Origin must match return_origin; code is consumed once.

Atomic tracked spending. Reuse action_id for retries; a new gameplay action needs a new ID.

Guest opening only: browser Origin must equal approved return_origin. Inherits configured global auth; use an isolated credential-free game context. Hosted UI authenticates before payment.

Hosted checkout only. Server issues an expiring one-time game handoff after verified fulfillment.

Save a catalog product. Prices use integer minor units and attached media must belong to the title.

Start/reuse owned Stripe Connect onboarding with one stable key. Provider KYC is factual setup, not a Glitch approval workflow.

User-authenticated quote. Clients select product/quantity, never monetary values or seller accounts.

Guest entry to hosted recovery, not inventory access. Exact approved Origin/return_origin required. Owning-account bind remains mandatory, including when commerce is off. Never install an account JWT in the game.

Admin read of separate-currency balances; pending is not withdrawable revenue.

Anonymous, read-only embedding policy: server-approved frame ancestors only, no player/session capability data.

Read the session using its limited capability. Cannot mutate user identity or declare payment.

Read title/environment delivery settings and the Ed25519 PUBLIC verification key.

Anonymous title-wide approved embedding policy for trusted hosted account pages; no player data.

Owner JWT/scoped player token or title admin. An arbitrary order UUID grants no access.

Inspect one same-title refund operation.

Discover safe event IDs/statuses before replay or acknowledge. Page 1–10000, per_page 1–100, default 25.

Restore authoritative durable ownership/current consumable balances, never mutable cloud-save balances.

Optional self-only purchase/usage history. A user JWT selects that user; a scoped playerToken selects its bound title/player/environment and requires the exact approved game Origin. No MCP/install token or caller-selected user_id/player_id is accepted. JWT environment defaults to live; scoped tokens default to their bound environment. Admin listOrders stays separate.

Read response.data.data.purchases and .pagination. Use grant_usage for lot consumption/refund/expiry status, listEntitlements for current aggregate inventory, and consume for explicit gameplay spending. History never grants inventory and durable/pass is_used is null rather than a guessed boolean.

Admin paginated redacted orders. Page 1–10000/per_page 1–100 (default 25); own-player history is separate.

Discover provider transfer/payout records; transferred funds are not automatically a verified bank payout.

Paginated admin catalog including drafts/archives. Default 200, per_page 1–200/page 1–10000. Use exact sku to resolve uncertain creates.

Deprecated

Compatibility overload for the earlier second-argument request options.

Financially scoped refund operation discovery; pending/unknown is not completed.

Title MCP token, never a runtime install token. Describes arguments, abilities, mutation semantics and provider facts.

Execute a discovered authorized operation directly. Legacy confirm is ignored and not forwarded.

Same title-authorized Media pipeline using the caller's MCP credential and commerce:write ability.

Actual provider configuration/capability facts; no credentials or manual approval flag.

Deprecated

Compatibility overload for the earlier second-argument request options.

Read-only current country/provider capability and revenue readiness; never fabricates availability.

Query original provider; never creates another charge. Pending/unknown remains non-terminal.

Financially scoped original-provider reconciliation. Does not reroute or start a different purchase.

Query/retry the original persisted refund with its existing identity, never generate a new refund key.

Refresh authenticated external provider facts. May update cached state; never creates a payment or invents eligibility.

Direct commerce:finance refund. REQUIRED stable idempotency_key; omission is an error, never auto-filled. Same-key changed input conflicts.

Replay the same immutable event. Receiver must deduplicate event_id. This cannot mint goods.

Owning user asks support to review a refund. This does not execute payment reversal.

Authenticated hosted Glitch account only: restore a previous purchase into a NEW nonce-bound session/handoff after the game's 15-minute token expires or storage is cleared. Does not create another payment. Return to the game via verified source/origin and a new bridge bound to event.checkout_session_id.

Admin settings, including immutable 1200bp commission and readiness blockers.

Direct commerce:fulfill setup. Private/metadata network targets and private-key inputs remain forbidden.

Update a product version. Existing order snapshots remain unchanged.

Direct commerce:finance configuration. Saving preferences does not fabricate external capability; inspect available/reasons.

Atomic policy update. Sandbox/off by default. Cannot disable the final working revenue model.

Upload an image/video through existing Glitch Media processing with title and actor ownership. Attach its returned Media ID to products/branding. Does not create a social-library post, scheduler, or new payment product.

Record integration proof from a genuinely paid, fulfilled sandbox order with a claimed game handoff.