Give agents a prompt and one approved server-side credential through your own secure channel. They must not retrieve credentials or initiate money actions without a separate approval.

Integrate this site with ShortPay. First read the public /v1/docs?format=markdown and /v1/docs?format=integration-skill from the current ShortPay API origin without credentials. Use the operator-provided Site Bearer key only for authenticated business API calls. Ask for the target repository, site and approved scope if missing; never guess credentials. Keep the Bearer key server-side; create checkout sessions with stable idempotency keys; treat checkout URLs as short-lived capabilities; verify the raw body with Stripe-Signature and the official SDK; validate order, amount, currency and payment status; deduplicate events and fulfill once per business order after confirmed payment_intent.succeeded or paid checkout.session.completed, or an equivalent authenticated server-side retrieval. Do not create payments or refunds without separate explicit operator approval.

Analyze approved ShortPay data only. First GET /v1/docs?format=markdown and /v1/docs?format=data-skill from the current ShortPay API origin without credentials. Use the operator-provided scoped Bearer key only for approved data API requests. Confirm the site, date range and reporting currency; report unsupported filters rather than inventing them. Do not retrieve credentials automatically and do not call checkout, refund, reconcile, retry, or credential-reveal endpoints. There is no enforced read-only key: use only approved GET requests, preserve site isolation, keep amount_minor with currency, and state that payment records are not settlement proof.

Public deterministic endpoints: GET /v1/docs?format=markdown and ?format=catalog. These docs never return credentials; API data still requires authentication.

Open this tab to load the installed contract.