You are helping integrate LinkJolt affiliate tracking with GoPay (Czech payment gateway).

## Context
- Merchant ID: YOUR_MERCHANT_ID
- Platform: GoPay
- Notification URL: https://www.linkjolt.io/api/webhooks/gopay?merchant=YOUR_MERCHANT_ID
- Tracking Script: https://www.linkjolt.io/api/tracking.js?id=YOUR_MERCHANT_ID

GoPay uses an OAuth2 client-credentials pull model. When a payment state changes, GoPay sends a GET request to `notification_url?id=PAYMENT_ID`. LinkJolt uses the merchant's saved Client ID / Client Secret to fetch payment details, then extracts tracking from `additional_params`.

## Step 1 — Install tracking script on your site

```html
<script src="https://www.linkjolt.io/api/tracking.js?id=YOUR_MERCHANT_ID" async></script>
```

## Step 2 — Save GoPay API credentials in LinkJolt

LinkJolt → Settings → Payment Providers → Create Webhook Secret → provider: **gopay**. Enter the GoPay Client ID + Client Secret from the GoPay merchant portal's API settings.

## Step 3 — Set notification_url when creating each payment

When your backend creates a GoPay payment via the GoPay API:

```json
{
  "amount": 1000,
  "currency": "CZK",
  "order_number": "ORDER_123",
  "notification_url": "https://www.linkjolt.io/api/webhooks/gopay?merchant=YOUR_MERCHANT_ID",
  "return_url": "https://your-site.com/thanks",
  "additional_params": [
    { "name": "tc",  "value": "TRACKING_CODE" },
    { "name": "aff", "value": "AFFILIATE_ID" },
    { "name": "cid", "value": "CLICK_ID" }
  ]
}
```

Client-side, read the values from the tracking script:
```javascript
const info = window.linkjolt.getTrackingInfo();
// info.trackingCode, info.affiliateId, info.clickId
// Send these to your server and include them in the GoPay payment-create call
```

GoPay's `additional_params` limit: max 4 entries, each 256 chars. Our tc/aff/cid values fit.

## Common issues

- "OAuth failed 401" → Client ID / Secret mismatch in LinkJolt's webhookSecrets. Re-enter from GoPay merchant portal.
- "Sandbox vs Production URL" → sandbox uses `gw.sandbox.gopay.com` for the OAuth2 token endpoint. LinkJolt routes this automatically based on the stored secret record's sandbox flag.
- "No conversion even though payment PAID" → `additional_params` missing on the GoPay payment-create call, or the affiliate click was older than the 30-day attribution window.