Custom shop or ERP

The server-side checks

• Receive the order from your page (the cutoptim:order event), with the quote and the order id.
• Verify the quote token with POST /cfg/v1/quote/verify and your secret key. Accept only valid: true with redeemed: true; reason: "unavailable" means not verified.
• Compare the token's claims with your cart: your tenant id, your currency, not expired.
• Look up the order with GET /cfg/v1/orders/{id} and compare its plan hash, quote hash and totals with the verified token.
• Create the cart line at the verified price, and remember the token's nonce so the same quote cannot become a second line.

Why a local check is not enough

The reference code can check a token locally: its shape, the 11 claims, the canonical form, your tenant and the expiry. It cannot prove the signature, because the signing key stays with CutOptim. Only the remote check says the price was signed by the service.

Receiving the webhook

Verify the signature over the raw body, deduplicate on the event id and answer 2xx; the full receiver is on Webhooks.

Reference code

Two small, dependency-free examples to read and copy: Node (cutoptim-verify.mjs, example-server.mjs) and PHP (CutOptimVerify.php, example-webhook.php). They are reference code, not a hosted service. Downloads and the walk-through: Custom platform and the help page.

• node/cutoptim-verify.mjs
• node/example-server.mjs
• php/CutOptimVerify.php
• php/example-webhook.php
• README.md