Give agents a prompt and one approved server-side credential through your own secure channel. They must not retrieve credentials or initiate money actions without a separate approval.

Integrate this site with ShortPay. With the operator-provided Site Bearer key, first GET https://shortpay.app/v1/docs?format=markdown and https://shortpay.app/v1/docs?format=integration-skill. Ask for the target repository, site and approved scope if missing; never guess credentials. Keep the Bearer key server-side; create checkout sessions with stable idempotency keys; treat checkout URLs and paySession as short-lived capabilities; verify raw ShortPay webhook signatures; deduplicate events and fulfill only after verified payment.succeeded. Do not create payments or refunds without separate explicit operator approval.

Analyze approved ShortPay data only. First GET https://shortpay.app/v1/docs?format=markdown and https://shortpay.app/v1/docs?format=data-skill with the operator-provided scoped Bearer key. Confirm the site, date range and reporting currency; report unsupported filters rather than inventing them. Do not retrieve credentials automatically and do not call checkout, refund, reconcile, retry, or credential-reveal endpoints. There is no enforced read-only key: use only approved GET requests, preserve site isolation, keep amount_minor with currency, and state that payment records are not settlement proof.

Authenticated deterministic endpoints: GET /v1/docs?format=markdown and ?format=catalog. These docs never return credentials.

Open this tab to load the installed contract.