> For the complete documentation index, see [llms.txt](https://swappulse.gitbook.io/swappulse-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://swappulse.gitbook.io/swappulse-docs/changelog/v0-9-0.md). # SwapPulse v0.9.0: Dormant TCGplayer API integration and affiliate-ready links Full release notes for SwapPulse v0.9.0. This release adds a carefully gated direct TCGplayer integration and prepares SwapPulse for the separate TCGplayer Affiliate Program without pretending that new API access is currently available. ## Added * Read-only TCGplayer API v1.39.0 client for existing authorised developer accounts. * Private `TcgplayerCache` and `TcgplayerUsage` entities with admin-only RLS. * TCGDex → TCGplayer conservative product mapping. * Direct TCGplayer market/low/mid/high pricing panel on Card Detail when authorised access is configured. * TCGplayer usage visibility in the Admin external-API budget panel. * Real Impact Partner Tracking Links API integration for TCGplayer deep links. * Affiliate disclosure adjacent to active TCGplayer affiliate links. * TCGplayer privacy, API, architecture and third-party documentation. * Authoritative root `openapi.yaml` contract using OpenAPI 3.1.0 for ReadMe-compatible SwapPulse public/authenticated product functions. * SwapPulse/Base44 specification extensions documenting visibility, privacy classification, canonical sources, provider roles, cache/rate policy, fail-soft behaviour and chain authority. * [OpenAPI maintenance guide](https://swappulse.gitbook.io/swappulse-docs/developers/openapi-contract) maintainer guide describing scope, exclusions and contract-update rules. ## Access state TCGplayer's current Getting Started documentation says new API access is no longer being granted. Direct API use in SwapPulse therefore remains dormant by default. It requires all of: * `TCGPLAYER_PUBLIC_KEY`; * `TCGPLAYER_PRIVATE_KEY`; * `TCGPLAYER_APPROVED_USE=true`, set only when the developer-key approval covers SwapPulse. Without approved use, the backend returns a fail-soft no-data response before reading credentials, minting a token or spending provider capacity. ## Read-only scope The SwapPulse client implements only catalogue/product/pricing reads. It deliberately does not expose: * store authorisation to ordinary users; * inventory writes; * seller-price writes; * buylist mutations; * orders; * customers/customer addresses; * store status or seller financial operations. ## Rate/performance policy TCGplayer does not publish a fixed numeric request ceiling in the current public documentation reviewed for this release, while its API Terms reserve the right to limit access/calls and prohibit excessive or unreasonable volume. SwapPulse therefore uses its own conservative default safety ceilings: * 30 calls/minute; * 1,000 calls/day; * 30-day card/product mapping cache; * 6-hour market-price cache; * 7-day safe stale fallback where permitted; * automatic pause on provider `429` / `Retry-After`. These values are SwapPulse operational limits, not claims about TCGplayer's provider ceiling. ## Attribution When direct TCGplayer pricing is displayed, SwapPulse: * identifies TCGplayer as the source; * links to the relevant TCGplayer destination; * displays the required notice: `This product uses TCGplayer data but is not endorsed or certified by TCGplayer.` ## Affiliate path TCGplayer's affiliate programme currently operates through Impact. New direct API access being closed does not prevent a separately approved affiliate relationship. SwapPulse uses Impact's Partner Tracking Links API directly. Backend authentication uses `IMPACT_ACCOUNT_SID` plus a scoped `IMPACT_AUTH_TOKEN`. The backend auto-discovers the joined TCGplayer programme unless `IMPACT_TCGPLAYER_PROGRAM_ID` is configured, verifies active/deep-link eligibility, creates a regular tracking link for the validated TCGplayer destination and caches generated links for 30 days. Impact currently documents a 1,000 requests/hour default for its "Other" partner API endpoint group. SwapPulse uses an 800/hour soft ceiling, records provider rate-limit headers and falls back to the ordinary TCGplayer destination if Impact is unavailable or throttled. When tracking is active, SwapPulse displays: `Affiliate link: SwapPulse may earn a commission from qualifying TCGplayer purchases at no extra cost to you.` Affiliate configuration does not enable the dormant direct TCGplayer API and does not bypass `TCGPLAYER_APPROVED_USE`. ## Security/privacy * TCGplayer developer keys/Bearer tokens and Impact Account SID/Auth Token remain backend-only. * Bearer tokens are cached in server process memory only, not Base44 entities. * Browser requests contain only the canonical TCGDex card ID. * No user identity, email, private collection notes, AT Protocol credentials or Web3 secrets are sent to TCGplayer. * TCGDex remains the canonical card identity source and ambiguous matches are rejected. ## API contract `openapi.yaml` is now the machine-readable product API contract. It documents the real Base44 HTTP function paths under `/functions/` and the equivalent first-party SDK calls without publishing private relay, verifier, provider-secret or irreversible admin surfaces. The contract uses OpenAPI specification extensions such as `x-base44-function-name`, `x-swappulse-canonical-source`, `x-swappulse-cache-policy`, `x-swappulse-rate-policy`, `x-swappulse-fail-soft` and `x-swappulse-authority` to preserve SwapPulse-specific trust and privacy semantics alongside ordinary OpenAPI tooling. ## Rationale SwapPulse already receives useful TCGplayer-derived information through PokéWallet, so direct TCGplayer API access is not required for the product to function. This release prepares a compliant direct read path for existing authorised credentials, makes the separate Impact affiliate programme the practical outbound-commerce route, and establishes a machine-readable public/product API contract for contributors and external integrations.