|
| 1 | +--- |
| 2 | +title: Browsing the Satsback Catalog With Your Agent — Affiliate Cashback, Paid in Bitcoin |
| 3 | +description: Register an AI agent with satsback.com over L402 + Nostr and point it at an affiliate catalog 1,580 stores deep (in Thailand alone) that pays cashback in bitcoin on lightning. |
| 4 | +date: 2026-04-23 |
| 5 | +tags: [bitcoin, lightning, l402, agents, affiliate] |
| 6 | +image: /blog/images/2026-04-23-browsing-satsback-catalog-with-your-agent.jpg |
| 7 | +imageAlt: A glowing cyan-green agent node on the left wired to a grid of small merchant-glyph tiles on the right, with a lightning bolt pipeline arcing back to the agent carrying coin dots, on a dark navy background. |
| 8 | +--- |
| 9 | + |
| 10 | +Every affiliate program on the open web wants the same things before it pays you a cent: a signup form, a dashboard login, a tax form, a bank account, a thirty-day hold, a fifty-dollar minimum payout. Your agent can't do any of that — and that's before it hits the captcha. |
| 11 | + |
| 12 | +That's the old model. Here's what the new one looks like: a signed Nostr event, 21 sats, a Bearer token. Your agent is in. |
| 13 | + |
| 14 | +## The handshake, start to finish |
| 15 | + |
| 16 | +satsback.com publishes an `agents.json` at the well-known path. No auth, no browser, just a description of how machines are supposed to talk to it: |
| 17 | + |
| 18 | +```bash |
| 19 | +curl https://satsback.com/.well-known/agents.json |
| 20 | +``` |
| 21 | + |
| 22 | +It tells you three things that matter: an L402 registration endpoint at `/api/v2/l402/register`, a Nostr event kind (`27236`) for agent identity, and a REST surface under `/api/v2/agent/*` for everything else. Agent identity is a secp256k1 pubkey. The lightning address where cashback lands is carried as a signed tag on the registration event. |
| 23 | + |
| 24 | +That's the whole identity model. No email. No password. No "verify you're a human." |
| 25 | + |
| 26 | +## Registration: 21 sats to open the door |
| 27 | + |
| 28 | +Build a kind-27236 event, sign it, and POST it: |
| 29 | + |
| 30 | +```json |
| 31 | +{ |
| 32 | + "kind": 27236, |
| 33 | + "created_at": 1776956959, |
| 34 | + "content": "register", |
| 35 | + "tags": [ |
| 36 | + ["country", "TH"], |
| 37 | + ["lightning_address", "lncurl_sinking_ash@getalby.com"] |
| 38 | + ], |
| 39 | + "pubkey": "c8f5d76a4930c0...", |
| 40 | + "sig": "8ff07faebeae..." |
| 41 | +} |
| 42 | +``` |
| 43 | + |
| 44 | +The server responds `HTTP 402` with an L402 challenge in the `WWW-Authenticate` header: |
| 45 | + |
| 46 | +``` |
| 47 | +WWW-Authenticate: L402 macaroon="MDAx...", invoice="lnbc210n1p575dnq..." |
| 48 | +``` |
| 49 | + |
| 50 | +Amount: **21 sats**. That's not a paywall — it's an anti-spam cost. It's roughly a cent. It exists so bots can't mint a million identities in a shell loop, and that's it. Pay it once, and you have a Bearer token tied to your lightning address. |
| 51 | + |
| 52 | +I let the Alby CLI handle the L402 dance — it pays the invoice, re-POSTs the event with `Authorization: L402 <macaroon>:<preimage>`, and you get the Bearer token back: |
| 53 | + |
| 54 | +```json |
| 55 | +{ |
| 56 | + "success": true, |
| 57 | + "token": "nI8BCtYqDeWUuJUr0e4Fw1KtRr2YfmqtDtEfe8Vg", |
| 58 | + "user_id": "end3q8Q", |
| 59 | + "quickstart": "Include 'Authorization: Bearer <token>' on ALL subsequent requests..." |
| 60 | +} |
| 61 | +``` |
| 62 | + |
| 63 | +Wallet balance before: 459,851 sats. After: 459,830 sats. That is the entire onboarding cost. |
| 64 | + |
| 65 | +## What's actually in the catalog |
| 66 | + |
| 67 | +With the Bearer token, hit the country-scoped stores endpoint: |
| 68 | + |
| 69 | +```bash |
| 70 | +curl -H "Authorization: Bearer $TOKEN" \ |
| 71 | + https://satsback.com/api/v2/agent/stores/thailand |
| 72 | +``` |
| 73 | + |
| 74 | +**1,580 stores** come back — a 2.2 MB JSON array. Each entry has the same rough shape: |
| 75 | + |
| 76 | +```json |
| 77 | +{ |
| 78 | + "name": "Booking.com", |
| 79 | + "slug": "booking-com", |
| 80 | + "url": "booking.com", |
| 81 | + "store_id": "WZjWp5Q", |
| 82 | + "cashback_type": "percent", |
| 83 | + "text": "Satsback up to 1.7%", |
| 84 | + "commission_percent": 1.7, |
| 85 | + "description": "..." |
| 86 | +} |
| 87 | +``` |
| 88 | + |
| 89 | +This is where the agent can actually browse. Not a hand-curated list of five "partner" merchants — 1,580 real stores across consumer, SaaS, travel, and long-tail e-commerce. A selection, with the kind of thing an agent might be buying on behalf of its user: |
| 90 | + |
| 91 | +| Store | Category | Cashback | |
| 92 | +| ------------------ | ----------- | -------- | |
| 93 | +| NordVPN | privacy | 20% | |
| 94 | +| Hostinger | hosting | 16.8% | |
| 95 | +| Proton / ProtonVPN | privacy | 16% | |
| 96 | +| ExpressVPN | privacy | 14% | |
| 97 | +| 1Password | credentials | 7% | |
| 98 | +| Shopee TH | marketplace | 5.5% | |
| 99 | +| AliExpress | marketplace | 2.7% | |
| 100 | +| Booking.com | travel | 1.7% | |
| 101 | +| Nike | apparel | 1.5% | |
| 102 | +| eBay US | marketplace | 1% | |
| 103 | + |
| 104 | +And at the top end, developer tooling is where the rates get serious — **Liquid Web** pays out up to **70%** and **Nexcess** up to **56%** on managed hosting. If your agent is provisioning infrastructure for its user, that's a meaningful slice of the bill coming back as sats. |
| 105 | + |
| 106 | +The bitcoin-adjacent stuff is well represented: Proton, NordVPN, ExpressVPN, Hostinger — the merchants that already take bitcoin in a lot of cases, now paying the agent for sending the user their way. |
| 107 | + |
| 108 | +## Turning a store into an attributed link |
| 109 | + |
| 110 | +Once the agent has picked a merchant, it calls `/visit`: |
| 111 | + |
| 112 | +```bash |
| 113 | +curl -H "Authorization: Bearer $TOKEN" \ |
| 114 | + https://satsback.com/api/v2/agent/store/booking-com/visit |
| 115 | +``` |
| 116 | + |
| 117 | +```json |
| 118 | +{ |
| 119 | + "store_id": "WZjWp5Q", |
| 120 | + "store_name": "Booking.com", |
| 121 | + "click_id": "QyR5rMn", |
| 122 | + "redirect_url": "https://satsback.com/api/v2/store/redirect/QyR5rMn", |
| 123 | + "tracking_tips": [ |
| 124 | + "Prefer using the same HTTP client/session for the redirect and checkout so the affiliate cookie is still present at order time.", |
| 125 | + "Call /visit again for every new order — do not reuse a click_id across purchases.", |
| 126 | + "Go directly from the redirect to checkout. Visiting coupon or comparison sites in between can overwrite attribution (last-click-wins).", |
| 127 | + "Preserve cookies and the redirect chain; do not strip them in your HTTP client.", |
| 128 | + "Complete the purchase soon after the click...", |
| 129 | + "For discount_code stores: still follow redirect_url AND apply cashback_code at checkout." |
| 130 | + ] |
| 131 | +} |
| 132 | +``` |
| 133 | + |
| 134 | +The agent takes that `redirect_url` to whatever it was already going to do — hand it to its browser runtime, pass it to the user, plug it into a shopping flow. The tracking tips are right there in the response: same HTTP client for redirect and checkout, one `click_id` per order, no coupon-site detours in between. If the agent respects those, attribution holds and cashback lands on the lightning address it registered with. |
| 135 | + |
| 136 | +## The rough edges |
| 137 | + |
| 138 | +None of this was entirely frictionless. Worth naming: |
| 139 | + |
| 140 | +- **Nostr signing isn't in the Alby CLI.** You need `nostr-tools` to schnorr-sign the kind-27236 event. Fine for developers, friction for pure shell-agent setups. |
| 141 | +- **The `notifications` tag is a trap.** Add `["notifications","true"]` without first publishing NIP-17 inbox relays for your pubkey and `/register` returns a 400 before it ever issues the invoice. |
| 142 | +- **Events are replay-protected.** POST once manually to see the 402 shape, then retry with the same event through a payment helper, and you get `400 Event already used`. Re-sign every attempt. |
| 143 | +- **`/register` rate limit is 3 per minute.** Easy to trip while debugging. |
| 144 | + |
| 145 | +## Why this is a big deal |
| 146 | + |
| 147 | +Affiliate is one of the oldest revenue models on the web and it has, until now, been built entirely around humans. Email signup. W-9. Dashboard login. Thirty-day hold. Fifty-dollar minimum payout. Every step of that stack assumes a person on the other end. |
| 148 | + |
| 149 | +satsback collapses the whole thing into a signed event, a 21-sat anti-spam cost, and a REST endpoint that mints attributed redirects on demand against over a thousand real stores per country. The agent that helps a user shop can now surface a bitcoin income on the transaction — without ever touching the user's email, card, or identity on the affiliate side. The cashback lands on lightning, in sats, paid to the address the agent signed into its registration event. |
| 150 | + |
| 151 | +The web spent twenty years assuming every visitor was a person. That assumption is breaking. What replaces it is cheaper, faster, and pays in bitcoin. |
| 152 | + |
| 153 | +--- |
| 154 | + |
| 155 | +## Get started |
| 156 | + |
| 157 | +Need a Lightning wallet for your agent? Create one in one command — no sign-up, no KYC: |
| 158 | + |
| 159 | +```bash |
| 160 | +curl -X POST https://lncurl.lol |
| 161 | +``` |
| 162 | + |
| 163 | +You'll get back a Nostr Wallet Connect URI. Fund it with a few sats and your agent can pay for APIs, services, and tools autonomously. |
| 164 | + |
| 165 | +Or give your agent the [lncurl skill](https://lncurl.lol/SKILL.md) directly. |
0 commit comments