Admin (server-only)

DANGER

/admin/* routes use x-admin-key, not the user Bearer token. GOMMO_ACCESS_TOKEN (merchant) lives in server .env only.

Operation	Gommo upstream	Gommo Developer
Merchant balance	POST .../ai/me + merchant token	GET /admin/merchant/balance
Send credits	POST .../users/sendBalances	POST /admin/credits/send
Register user	POST .../auth/register	POST /admin/users/register

Server env

Variable	Purpose
GOMMO_ACCESS_TOKEN	Merchant token
GOMMO_API_DOMAIN	Merchant domain (see .env.example)
GOMMO_MANAGER_ID	manager_id for register
TOPUP_MERCHANT_BUFFER_CREDITS	Optional extra buffer (default 300k); effective rule is Gommo > 500k remaining after send — only set above 500k if you want stricter guard
ADMIN_API_KEY	Protects /admin/*

Gommo rule: after sendBalances, merchant must retain > 500,000 credits.

---

Merchant balance

curl

curl.exe "http://localhost:3001/admin/merchant/balance" ^
  -H "x-admin-key: YOUR_ADMIN_KEY"

PowerShell

$h = @{ 'x-admin-key' = $env:ADMIN_API_KEY }
Invoke-RestMethod "http://localhost:3001/admin/merchant/balance" -Headers $h

---

Send credits

{
  "username": "gommo_username",
  "value": 100,
  "message": "Topup test",
  "type": "credits_ai"
}

curl

curl.exe -X POST "http://localhost:3001/admin/credits/send" ^
  -H "x-admin-key: YOUR_ADMIN_KEY" -H "Content-Type: application/json" ^
  -d "{\"username\":\"user1\",\"value\":100,\"message\":\"Test topup\"}"

PowerShell

$body = @{ username = 'user1'; value = 100; message = 'Test topup' } | ConvertTo-Json
Invoke-RestMethod -Method POST -Uri "http://localhost:3001/admin/credits/send" `
  -Headers @{ 'x-admin-key' = $env:ADMIN_API_KEY; 'Content-Type' = 'application/json' } `
  -Body $body

sendBalances permission is granted by Gommo to the merchant account domain.

---

Register user

curl

curl.exe -X POST "http://localhost:3001/admin/users/register" ^
  -H "x-admin-key: YOUR_ADMIN_KEY" -H "Content-Type: application/json" ^
  -d "{\"email\":\"[email protected]\",\"password\":\"secret12\",\"phone\":\"0900000000\"}"

PowerShell

$body = @{
  email = '[email protected]'
  password = 'secret12'
  phone = '0900000000'
} | ConvertTo-Json
Invoke-RestMethod -Method POST -Uri "http://localhost:3001/admin/users/register" `
  -Headers @{ 'x-admin-key' = $env:ADMIN_API_KEY; 'Content-Type' = 'application/json' } `
  -Body $body

Script: scripts/test-admin.ps1