In a real store: validate runs in the browser (public), and redeem
runs on your server after payment with your secret API key — never in
client code. This page fakes payment and calls redeem only so you can see the
full loop and the sale appear on your dashboard.