Start Money Config Tools API Fraud Security

Live · residual-only · max 20× markup

Sell D3AL products from any AI agent storefront

Paste this MCP URL into Cursor, Claude, Grok, or any agent. The agent can create a mini-store, set retail prices, and hand buyers a checkout link. Payments and fulfillment stay on D3AL / Clickoor. You earn residual (retail − wholesale) in your affiliate balance.

Get started Copy MCP config Browse catalog

residual_onlyMoney model

20×Max markup

14MCP tools

Quick start

Three steps for affiliates. Any registered affiliate can enable partner stores.

1. Become an affiliate + get a key

From your agent: call partner_onboard with a handle and EVM payout address. The tool creates the affiliate (or resumes if the EVM matches) and returns a ckptr_… key once.

From the website: log into the affiliate dashboard → API and click Create key.

2. Connect your agent

Point the MCP server URL at https://d3al.xyz/mcp with header Authorization: Bearer ckptr_…

3. Build & price

Ask the agent to call partner_create_store, then partner_upsert_offer (retail ≥ wholesale, ≤ 20×). Share https://d3al.xyz/s/{slug}.

Money rules

Platform-collect residual. Crypto checkout only in v1.

How settlement works

Buyer pays full retail to Clickoor payment addresses.
Payment intent locks the retail amount (anti underpay / sniping).
After the order is verified/activated, residual credits your claim balance.
Withdraw via the normal affiliate claims flow.

Wholesale always comes from live plan settings — not the client.

What you can set

Retail price per product + plan
Store name, slug, theme (colors / tagline)
Offer on/off and short condition text

What you cannot do

Price below wholesale or above 20×
Receive retail funds to your own wallet via this checkout
Read content-locker secrets via MCP
Stack ladder commission on residual orders

Agent configuration

Remote HTTP MCP. Replace the key after creating one from your affiliate session.

TOML (Grok / many clients)

[mcp_servers.d3al_partner]
url = "https://d3al.xyz/mcp"
headers = { Authorization = "Bearer ckptr_YOUR_KEY_HERE" }

JSON (Cursor / Claude Desktop style)

{
    "mcpServers": {
        "d3al_partner": {
            "url": "https://d3al.xyz/mcp",
            "headers": {
                "Authorization": "Bearer ckptr_YOUR_KEY_HERE"
            }
        }
    }
}

Onboard from an agent (no key yet)

Call MCP partner_onboard, or POST handle + EVM. Save the ckptr_ secret, then add it to the config above.

# From an agent terminal — no browser session. Returns ckptr_ once.
curl -sS -X POST "https://d3al.xyz/v2-api.php?action=partner_onboard" \
  -H "Content-Type: application/json" \
  -d '{"handle":"yourname","evm_address":"0xYOUR_EVM_PAYOUT_ADDRESS"}'

# Keys go in Authorization only — never ?api_key= (it leaks in logs).
# Optional REST signing (not used by Cursor/Grok MCP):
#   X-Partner-Timestamp, X-Partner-Nonce,
#   X-Partner-Signature = hex(HMAC-SHA256(key, ts + "\\n" + nonce + "\\n" + METHOD + "\\n" + path + "\\n" + sha256(body)))

Create key (session)

While authenticated as an affiliate, create a key (CSRF required):

# While logged into affiliate dashboard, open browser console on d3al.xyz
# Or call with session cookie + CSRF from /v2-api.php?action=session
curl -sS -X POST "https://d3al.xyz/v2-api.php?action=partner_create_key" \
  -H "Content-Type: application/json" \
  -H "X-CSRF-Token: YOUR_CSRF" \
  -H "Cookie: YOUR_SESSION" \
  -d '{"name":"mcp-default"}'

Endpoint: POST https://d3al.xyz/v2-api.php?action=partner_create_key

MCP tools

JSON-RPC methods tools/list and tools/call. Auth required except docs metadata on GET.

Tool	Purpose	Auth
`partner_docs`	Money rules, security notes, and how residual pricing works for reseller mini-stores.	Public
`partner_onboard`	Onboard as a D3AL affiliate from this agent (no browser). Pass a unique handle + your EVM payout address. Creates the affiliate if new, or resumes if the EVM matches. Returns a ckptr_ API key ONCE — save it in MCP config then call partner_whoami. Optional referrer handle.	Public
`partner_whoami`	Return the authenticated partner handle, scopes, and claim balance.	Bearer key
`partner_catalog`	List resellable products/plans with wholesale floor, min/max retail (max 20×), and residual model notes.	Bearer key
`partner_create_store`	Create a mini-store (slug + name). Returns store_url https://d3al.xyz/s/{slug} and publishable_id for public checkout.	Bearer key
`partner_list_stores`	List stores owned by the partner, including offers.	Bearer key
`partner_update_store`	Update store name, status (draft\|live\|suspended), or theme.	Bearer key
`partner_upsert_offer`	Set retail price for a product/plan on a store. Retail must be >= wholesale and <= 20× wholesale. Residual = retail − wholesale credits affiliate balance after paid.	Bearer key
`partner_list_orders`	List recent orders on your book including fingerprint_id, IP, and device_type (no locker secrets).	Bearer key
`partner_antifraud`	Required anti-fraud + first-party fingerprinting stack for MCP storefronts: 10-minute pay window, device/IP binding, tx-hash anti-snipe. Use this when building a custom storefront.	Public
`partner_order_signals`	Fraud signals for one of your orders: fingerprint, IP, device, plus your other orders that share the same fingerprint or IP.	Bearer key
`partner_balance`	Affiliate claim balance including residual store earnings.	Bearer key
`partner_get_storefront_snippet`	Return iframe snippet + hosted URL. Prefer partner_export_storefront to deploy a full separate site.	Bearer key
`partner_export_storefront`	Export a standalone HTML storefront you can host on any domain (Netlify, Cloudflare Pages, GitHub Pages, VPS). Uses publishable_id only — never the API key. Includes 10-minute pay window + first-party fingerprint.	Bearer key

Example tool call

{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
        "name": "partner_upsert_offer",
        "arguments": {
            "store_id": 1,
            "product": "x_premium",
            "plan_duration": "6 months",
            "retail_price_usd": 50,
            "active": true
        }
    }
}

HTTP API (same backend)

Useful if you build a storefront without MCP tools. Full REST lives on v2-api.php.

Partner (Bearer key)

GET ?action=partner_whoami

GET ?action=partner_catalog

GET ?action=partner_list_stores

POST ?action=partner_create_store

POST ?action=partner_upsert_offer

GET ?action=partner_list_orders

GET ?action=partner_balance

Base: https://d3al.xyz/v2-api.php

Public storefront checkout

Use only the store publishable_id — never the secret key.

GET ?action=partner_public_store&slug=…

POST ?action=partner_create_checkout_session

{
  "publishable_id": "32_char_hex_from_store",
  "product": "x_premium",
  "plan_duration": "6 months",
  "username": "buyerhandle",
  "accept_terms": true
}

Then pay exact amount_usd and submit_order with claim_token.

Hosted UI: https://d3al.xyz/s/{slug}

Separate site: call partner_export_storefront and host the returned html as index.html on any static host. Checkout uses CORS + 10‑minute pay window.

Deploy as a separate site

Agents can export a full HTML storefront and host it on any domain. Payments still go to D3AL.

1. Export

After the store is live with offers, call partner_export_storefront with store_id.

The tool returns a complete html document (theme, offers, 10‑minute timer, first-party fingerprint).

2. Host

Save as index.html
Netlify Drop / Cloudflare Pages / GitHub Pages / any nginx root
Point a custom domain at that host
No PHP, no ckptr_ key on the site

Anti-fraud & fingerprinting

Every MCP storefront (hosted or exported) uses the same first-party stack as d3al.xyz checkout. Agents: call partner_antifraud.

Required on every checkout

fingerprint_id — first-party SHA-256 of canvas, WebGL, audio, fonts, hardware, locale. No third-party vendor.
10-minute pay window — claim token expires; late submit is rejected.
Same device — submit fingerprint must match the session that started pay.
IP tracking — stored on intent + order; /24 (IPv4) or /64 (IPv6) soft bind.

Tx-hash theft (sniping)

Reject addresses pasted as hashes
On-chain amount + recipient verify
Reject txs confirmed before this session
Global unique claim on the hash — first valid submit wins

Review your book: partner_list_orders (includes fp / IP / device) and partner_order_signals.

Security checklist

Designed to close underpayment, key leak, sniping, and cross-tenant abuse.

✓Buyer pays full retail in crypto to Clickoor wallets (platform-collect).

✓Platform keeps wholesale (catalog plan price).

✓Partner residual = retail − wholesale, credited to affiliate claim balance after order is activated/verified.

✓Ladder/flat referral commission is NOT stacked on residual store orders.

✓Retail must be between wholesale and wholesale × max_markup_mult.

✓Never put partner API keys in public storefront JavaScript.

✓Content locker secrets are never exposed via partner MCP/API.

✓Fulfillment is always handled by Clickoor.

✓External storefronts use publishable_id + claim_token only. Checkout has a 10-minute pay window and a first-party device fingerprint.

Keys: store hashed server-side · shown once · rotate by creating a new key · scopes: stores, offers, orders, balance, catalog, checkout. Content locker credentials are never returned to partner MCP tools.

Protocol notes

For agent implementers and debugging.

Transport: HTTPS JSON-RPC over POST (initialize, tools/list, tools/call, ping).
Browser GET: this page at https://d3al.xyz/mcp (SPA-clean URL; no .php).
Machine GET: https://d3al.xyz/mcp?format=json
Shorthand: POST {"tool":"partner_docs"} (optional for simple clients).
CORS: open for tool clients; never put secrets in front-end code.