Developer docs

<div id="munja-moment"></div>
<script async src="https://getmunja.com/v1.js" data-key="pk_test_..."></script>
<script>
  window.Munja = window.Munja || [];
  Munja.push(["show", {
    order: { id: "ORDER-1042", signature: "SIGNED_ON_YOUR_SERVER" },
    customer: { email: "dana@example.com", name: "Dana" },
    context: { zip: "60614", newCustomer: true, orderTotal: 129.0 }
  }]);
</script>

import { createHmac } from "node:crypto";

// orderId and email are the same values you pass to Munja.show
const signature = createHmac("sha256", process.env.MUNJA_SIGNING_SECRET)
  .update(`${orderId}.${email.trim().toLowerCase()}`)
  .digest("hex");

context: {
  zip: "60614",              // decides which local partners can appear
  newCustomer: true,         // first order with you (true, false, or leave out)
  orderTotal: 129.00,        // dollars; or orderTotalCents: 12900
  products: [                // names or SKUs, or { name, sku } objects
    { name: "2 bedroom move", sku: "MOVE-2BR" }
  ],
  moveDate: "2026-11-14"     // industry fields: see the table
}

<script async src="https://getmunja.com/v1.js" data-key="pk_test_..." data-exit="on"></script>

<!-- If your site opens its own popup, tell Munja so it stays out for the visit -->
<script>
  window.Munja = window.Munja || [];
  Munja.push(["sitePopupShown"]);
</script>

<!-- Fill these from your own order record when the page renders -->
<div id="munja-moment"></div>
<script async src="https://getmunja.com/v1.js"
        data-key="pk_test_..."
        data-order="ORDER_ID"
        data-signature="SIGNATURE_FROM_YOUR_SERVER"
        data-email="CUSTOMER_EMAIL"
        data-name="CUSTOMER_FIRST_NAME"></script>

const res = await fetch("https://getmunja.com/v1/offers", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    key: "pk_test_...",
    order: { id: "ORDER-1042", signature },
    customer: { email: "dana@example.com", name: "Dana" },
    context: { zip: "60614" },
  }),
});
const { data } = await res.json(); // [] means show nothing

{
  "object": "offer_list",
  "decision": "dec_...",
  "livemode": false,
  "data": [
    {
      "impression": "imp_token_...",
      "position": 1,
      "partner": "Partner name",
      "headline": "...",
      "body": "...",
      "cta": "Yes, contact me",
      "consent": "Text shown next to the button"
    }
  ],
  "moment": { "merchant": "...", "title": "...", "layout": "stack" }
}

await fetch(`https://getmunja.com/v1/offers/${encodeURIComponent(offer.impression)}/accept`, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email: "dana@example.com", name: "Dana" }),
});

const res = await fetch("https://getmunja.com/api/v1/leads", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.MUNJA_SECRET_KEY}`,
    "Idempotency-Key": `${orderId}-${offerId}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ offer_id: offerId, email, disclosure_text: shownText, contact: { name } }),
});
// 201 { "id": "lead_...", "object": "lead", "status": "charged" | "duplicate", ... }

await fetch("https://getmunja.com/api/v1/conversions", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.MUNJA_SECRET_KEY}`, "Idempotency-Key": externalId, "Content-Type": "application/json" },
  body: JSON.stringify({ mj_click_id: clickId, type: "purchase", value: 4900, external_id: externalId }),
});

curl https://getmunja.com/api/v1/refund_requests \
  -H "Authorization: Bearer sk_test_..." \
  -H "Idempotency-Key: refund-lead_..." \
  -H "Content-Type: application/json" \
  -d '{"lead":"lead_...","reason":"wrong_contact","note":"Number disconnected"}'

{
  "id": "evt_...",
  "object": "event",
  "type": "lead.created",
  "livemode": false,
  "created": 1793548800,
  "data": {
    "object": {
      "object": "lead",
      "id": "lead_...",
      "mj_click_id": "mjc_...",
      "offer": "ofr_...",
      "merchant": "acct_...",
      "price_cents": 3800,
      "created": 1793548800,
      "customer": { "email": "dana@example.com", "name": "Dana" }
    }
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

// rawBody is the exact request body string, before JSON parsing
export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = Number(parts.t);
  if (!t || !parts.v1 || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return expected.length === parts.v1.length && timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

HTTP/1.1 401
{
  "error": {
    "type": "authentication_error",
    "code": "invalid_signature",
    "message": "The order signature does not match. ...",
    "param": "signature",
    "doc_url": "/docs/api#invalid_signature"
  }
}