API endpoints: /api/coupons, /api/purchases (bearer auth required)