Fix PCM auth: login for API token and multi webhook secrets.

PCM DirectMail v3 needs POST /auth/login (apiKey+apiSecret) before design/order calls; accept each subscription's copy-only signature secret via PCM_WEBHOOK_SECRETS.
2026-08-09 06:02:32 -05:00
parent 1ef6624a8b
commit 7496af72d0
8 changed files with 299 additions and 33 deletions
@@ -40,10 +40,16 @@ SMTP2GO_SMS_API_KEY=
 SMTP2GO_WEBHOOK_SECRET=

 # Postcards — PCM Integrations (DirectMail API v3)
+# Portal → My Account → API Keys: copy Sandbox or Production key + secret.
+# App POSTs /auth/login then uses the returned Bearer token (not the raw key).
 POSTCARD_PROVIDER=pcm
 PCM_API_KEY=
-# Inbound webhook auth (Bearer / ?token=) — set a long random string
-PCM_WEBHOOK_SECRET=
+PCM_API_SECRET=
+# Optional: PCM_CHILD_REF_NBR=
+# Inbound webhook auth — PCM generates one signature secret per subscription.
+# Paste all of them comma-separated (also accepts single PCM_WEBHOOK_SECRET=).
+PCM_WEBHOOK_SECRETS=
+# PCM_WEBHOOK_SECRET=
 # Return address on every postcard order (JSON). Example:
 # PCM_RETURN_ADDRESS={"firstName":"Monica","lastName":"Dhillon","address":"123 Main St","city":"Naperville","state":"IL","zipCode":"60540"}
 PCM_RETURN_ADDRESS=