Paywall is built so an agent can do the whole job: read a self-contained guide, configure one app through a scoped token, create plans and feature flags, publish, and track the result. You review it on the dashboard.
Mint a token on the app's Overview page, paste it into the placeholder, and give the prompt to Claude Code, Codex or Cursor. Nothing else needs explaining.
Integrate Paywall into this app. Read https://paywallhq.com/integrate.md first and follow it exactly. If this app already integrates Paywall, read https://paywallhq.com/upgrade.md and https://paywallhq.com/changelog.json first. Compare SDK copies with https://paywallhq.com/vendor/manifest.json, preserve local customizations, and follow the relevant feature adoption steps. Context: - Paywall base URL: https://paywallhq.com - App admin token: <paste the at_… token from the app's Overview page> - This app keeps its own auth and users. Paywall only decides what each user is allowed to do and takes the payment. Do this end to end: 1. Fetch the app detail with the token to get the publishable (pk_) and secret (sk_) keys. 2. Create the feature flags this app needs — boolean for on/off, number for limits, text for tier names. 3. Create a free default plan and a paid plan, grant the right features to each, and add a price to the paid plan. 4. Enable the simulated provider so the flow can be tested without real credentials, then publish. 5. Vendor the SDK files, call identify after login, gate features from the entitlement token, and add a checkout call for the upgrade. 6. Track the key steps with hub.track() so the funnel shows up on the Paywall dashboard. 7. Run one upgrade against the simulated provider and show me the result. Never put a payment credential in this app. If any Paywall call returns 401 or 403, stop and ask me for a fresh token.
The prompt points at this hub, so a local dev hub hands out local URLs and the production hub hands out paywallhq.com.
Each step is a plain HTTP call against the admin API or a file the agent writes into your app. All of it shows up on the dashboard as it happens.
One GET returns the publishable and secret keys. The token is scoped to this app, so there is nothing else it could read.
curl -H "Authorization: Bearer $APP_TOKEN" \
https://paywallhq.com/v1/admin/apps/<slug>
# -> { publishable_key: pk_…, secret_key: sk_… }Boolean, number and text flags. A free default plan and a paid plan with grants and a price. Then it publishes the catalogue to the edge.
POST …/features { "key": "exports", "type": "number" }
POST …/plans { "key": "pro", "name": "Pro" }
PUT …/plans/pro/features/exports { "enabled": true, "limit": 500 }
POST …/plans/pro/prices { "currency": "usd", "amount": 1200 }
POST …/publishThree vendored files, no npm dependency. Identify after your own login, gate from the token, checkout on upgrade.
const session = await hub.identify({ userId, email });
const claims = await hub.verifyToken(session.token);
if (!claims.features.exports) deny();The hub already emits checkout created, payment succeeded, declined and refunded. The agent adds the client-side steps so anonymous visits stitch to paying customers.
const track = useTrack();
track("pricing_viewed", { plan: "pro" });
// 30-day counts + per-customer timeline on the dashboardAgents fail on billing integrations when the docs are scattered, the credentials are shared, and there is no way to test without a real account. Paywall removes all three.
/integrate.md carries the architecture, every flow's code and the full API reference, with the base URL already resolved. /llms.txt points at it.
An app admin token reaches one app, can't list or create apps, and expires when you say. Revoke it from the dashboard at any time.
The agent never sees a Stripe or Razorpay key. Provider credentials are stored per app inside the hub and never leave it.
Framework-agnostic, zero-dependency files at /vendor/hub-*.js. Vendor them, don't install them.
A built-in provider with a hosted approve/decline page lets the agent run the whole flow before any payment account exists.
Every call the agent makes lands on the dashboard: features, plans, publish state, webhook log and tracked events. You verify by looking.
Create an app, open its Overview page, and create an agent token with the expiry you want. The prompt above does the rest.