AI agents and llms.txt

Docs for language models, a brief to give your coding agent, and the rules for agents that move money.

Coding agents (Claude Code, Cursor, Copilot and others) and agents that act for people can both use AutoPayKe. This page gives them what they need to get it right, and sets out the rules for an agent moving real money.

Machine-readable docs

File	What's in it
/llms.txt	A short index of AutoPayKe and every docs page, for language models (llmstxt.org format).
/llms-full.txt	The full text of every docs page in one file. Give this to an agent as context.
/openapi.json	OpenAPI 3.1: every endpoint, field, scope, error and example. The most precise source.

A brief to paste into your agent

Put this in your agent's instructions (CLAUDE.md, .cursorrules, a system prompt) when it works on your AutoPayKe integration:

AUTOPAYKE.md

You are integrating the AutoPayKe partner API (Kenyan payouts paid from USDC).

Facts:
- Base URL: https://api.autopayke.com. Every path starts /api/v1.
- Auth: header "Authorization: Bearer <key>". apk_test_ keys = sandbox (no real money); apk_live_ keys = real money.
  Read the key from the environment variable AUTOPAYKE_API_KEY. Never hard-code, log or print it.
- Responses: {"ok": true, "data": …} or {"ok": false, "error", "code", "requestId", "details"?}. Branch on "code".
- Payout amounts are integer KES cents and must be whole shillings (multiple of 100). 150000 = KES 1,500.
- POST /api/v1/payouts needs an "Idempotency-Key" header (8-128 chars). Generate it once per intended payout, persist it
  with the record BEFORE the first attempt, and reuse it on every retry of that payout.
- Destinations: mobile_money {phone, network?: safaricom|airtel, name?}; till {till_number}; paybill {paybill_number,
  account_number}; bank {bank_code from GET /api/v1/banks, account_number, account_name}.
- Status flow: pending -> processing -> succeeded (-> reversed); or failed; in_review can pause it. failed/reversed return the money.
- Final status comes from webhooks (payout.succeeded / payout.failed / payout.reversed). Verify AutoPayKe-Signature:
  "t=<unix>,v1=<hex>", v1 = HMAC-SHA256(secret, f"{t}.{raw_body}"); reject if |now - t| > 300s. Dedupe by event id.
- Retry only on network errors, HTTP 5xx, RATE_LIMITED, IDEMPOTENCY_IN_PROGRESS, CAPABILITY_PAUSED, METHOD_UNAVAILABLE,
  with exponential backoff and the same Idempotency-Key. Never retry other 4xx without changing the request.
- Sandbox: +254700000001 succeeds, +254700000002 fails, +254700000003 in_review, +254700000004 reverses,
  amount 13300 times out, account 0000000000 fails. Add test funds with POST /api/v1/sandbox/faucet.
- Reference: https://www.autopayke.com/developers/api/payouts · OpenAPI: https://www.autopayke.com/openapi.json
  · Full docs as text: https://www.autopayke.com/llms-full.txt

Rules for you, the agent:
- Use test keys and sandbox values only, unless the human explicitly gives you a live key AND confirms each live payout.
- Never invent endpoints or fields; if unsure, read the OpenAPI file.
- Show the human the amount, recipient and quote before any live payout.

Letting an agent send money

If an AI agent in your product can trigger payouts, the guardrails are yours to build, and we expect them:

Give the agent's service its own live key, with only payouts:read, payouts:write and recipients:read, and an IP allowlist.
Cap amounts per payout, per person and per day in your code, well below your workspace limits.
Allow payouts only to recipients a person has already confirmed (verify the name first), not to numbers the agent found.
Have a person approve payouts above a threshold, showing amount, recipient name and fee from a quote.
Generate the Idempotency-Key in your code, not in the model's output, so a repeated tool call can't pay twice.
Log every agent action with the payout id and requestId, and keep a way to stop the agent at once (revoke its key).
Treat text from users, web pages or documents as data, never as instructions to pay someone.

A model can be talked into things. The Idempotency-Key, amount caps, allowlisted recipients and human approval have to live in your code, where the model can't change them.

Agents and the public endpoints

For coding agents

Every docs page has a Copy page button that copies it as Markdown, ready to paste into Claude, ChatGPT or your editor's assistant. The site also publishes files written for language models:

https://www.autopayke.com/llms.txt        # what AutoPayKe is, and an index of every page
https://www.autopayke.com/llms-full.txt   # the text of every page
https://www.autopayke.com/openapi.json    # every endpoint, machine-readable

What agents can do today

Read coverage, prices and quotes through the public endpoints, useful for an assistant that answers "how much will they receive?" or "can I pay this Till?".

Agent-initiated payments

Not live. Before any software moves money on someone's behalf we're building the controls it needs:

Per-person spending limits
Allow-lists of recipients and corridors
Anomalies flagged for a person to review
A full audit log
An instant off switch

Nothing in the product creates agent-initiated transactions today. We'll say so clearly here when that changes.