Partner OAuth Integration Guide

This guide outlines how user authentication and cash back tracking will work between your system and the Wildfire-hosted Shopping Portal. It’s designed to help you understand the authentication user flow and align on what’s needed to begin integration.

Overview Overview

Our shared goal is to deliver a seamless, white-labeled shopping experience where:

• Users authenticate through your login system (OAuth-based).
• Users shop and activate cash back offers on the Wildfire-hosted Shopping Portal.
• We track purchases and return user-level attribution using your identifiers.

Summary of User Flow Summary of User Flow

The following user flow and sequence diagram describe a typical implementation of OAuth-based authentication and purchase tracking.

We recognize that OAuth implementations vary by partner — including grant types, token exchange steps, user info formats, and refresh mechanisms. We're flexible and will integrate with the specific OAuth flow your system supports. Our goal is to accommodate your existing architecture while ensuring secure and consistent user identification for cash back tracking.

Authentication and Tracking Flow Authentication and Tracking Flow

1. User lands on your white-labeled shopping website (hosted by Wildfire).
2. User clicks “Log in.”
3. User is redirected to your OAuth login endpoint, with a return URI to the Wildfire-hosted Shopping Portal.
4. User authenticates on your login page.
5. Your system returns an authorization code or token, depending on your OAuth implementation.
6. Wildfire uses the token to retrieve an Anonymized User Identifier (AUI) — typically from the sub field, but configurable based on your token format. We recommend using a UUID as the AUI, though the choice is up to your system.
7. The AUI is stored in the Wildfire system and tied to the user session.
8. When the user activates a cash back offer, the AUI is included in the event payload.
9. When a merchant confirms a purchase, the purchase is associated with the AUI.
10. Wildfire makes commission event data available via the Commission API, which your system can map individual commissions using the anonymized user identifier (AUI) to credit the appropriate user.

• If your system registers for callbacks, Wildfire will also send a best-effort notification when a commission is imported or when its status changes. Note that callbacks are fire-and-forget and not retried — the Commission API should be treated as the system of record.

Note: For users already authenticated in your ecosystem and sent to the shopping portal, you may begin at step 5 by including the authorization code or token in the redirect.

Example Flow Diagram Example Flow Diagram

What We Need From You What We Need From You

To integrate with your OAuth system, we’ll need:

• OAuth authorization and token endpoint URLs
• Client ID (and client secret, if applicable)
• List of required scopes
• The token format you use (e.g., JWT or opaque), and validation method
• The user identifier field to use as the AUI
• Confirmation of redirect URI allowlisting
• Any additional requirements related to session handling or error formatting

If you have a developer portal with OAuth documentation, providing access is a great way to accelerate the integration process.

Updated: 17 Jun 2026