Before you start the agent
The agent writes the code, but it will not open an account or invent keys for you - these have to come from your side:
Plus the one-time setup - product, webhook and assigning the webhook to the product - described in Setup. The agent does it for you: it needs the API key and the
partnerId, and asks for the rest. Skipping that last step is the most common slip: payments work, notifications never arrive.
An agent given
skill.md asks for the API key and stops until you provide it - instead of putting made-up values into the code. If you have no product or webhook yet, it walks you through creating them: in a single message it asks for the shop name and the other required fields, proposes defaults, lists the optional fields, shows you the request to approve and sends it itself. It reads productId and signingSecret from the API responses and stores them in environment variables.The fastest route
Paste this URL to your agent:Works in Cursor, Claude Code, Windsurf, Lovable and anywhere else an agent can fetch a URL.
Persistent project configuration
If you want your agent to remember the Paymove rules for every task, add them to your repository once. Copy the contents of:AGENTS.md, CLAUDE.md or .cursor/rules/paymove.md file in your project. From then on a prompt like “add payments” is enough - the agent picks up the right rules by itself.
Every page as Markdown
Append.md to any URL in these docs to get clean Markdown with no interface chrome:
Documentation map for models
The rules agents get wrong most often
Whether you are writing the integration yourself or reviewing code an agent produced, check these points:- Amounts are integers in grosze.
12.99is silently truncated to 12 grosze and the API returns200. Convert withMath.round(amount * 100). - Authenticate with
X-API-KEY, notAuthorization: Bearer. - Server-side only. The key must not reach the frontend, and a browser call fails CORS anyway.
- Always verify
X-Paymove-Signaturebefore fulfilling an order. - Never fulfil an order on
returnUrl- that is only a browser redirect. - Unknown fields are ignored and the response is
200- a malformed request looks like success. - There is no rate limiting, no
429, no422and noIdempotency-Key- code handling those cases is dead weight.