Agent integration
A concise checklist for using coding agents to add ATM checkout, webhooks, and tests safely.
Compatible with the closed-beta ATM app APIs and versioned ATM event headers. Check atm-api-version on every webhook or XRPC receiver event.
What to give the agent
Coding agents work best when they get a narrow ATM contract, a starter file, and a verification loop. Give the agent the package docs, your app's order model, and the exact backend route where checkout should start.
Server-side helpers for checkout, status, webhooks, XRPC receivers, and Tickets.
Open guidellms.txtShort machine-readable context that tells agents when and how to use ATM.
Open guideFull agent contextLonger agent prompt template, architecture summary, and safety boundaries.
Open guideMCP for agentsA local test-mode wrapper for ATM docs, fixtures, delivery logs, and config inspection.
Open guideFramework examplesNext, Node, Express, Fastify, Hono, and Worker-oriented examples.
Open guideTesting packageSigned fixture helpers for app receiver tests.
Open guideWebhook test consoleGenerate a test event and redrive receiver behavior.
Open guideDiscovery files
ATM exposes public agent discovery files at the root of atmosphere.money. Point coding agents at these before asking them to wire payments so they choose the hosted ATM flow, server SDK, verified events, and private-data boundaries from the start.
| https://atmosphere.money/llms.txt | Short index of the ATM docs, SDK packages, default recommendation, and do-not-cross boundaries. |
|---|---|
| https://atmosphere.money/llms-full.txt | Longer agent context with architecture, checkout sequence, tickets sequence, auth model, and a copyable prompt. |
| https://atmosphere.money/sitemap.xml | Search and crawler index for the docs entry points agents should find. |
MCP wrapper
@atmosphere-money/mcp is the agent-friendly local wrapper for ATM developer actions. It is deliberately scoped to integration work: docs discovery, signed fixtures, app config inspection, test event delivery, delivery logs, test redrive, and test checkout initiation with caller-supplied service-auth.
Safe implementation boundary
The agent should write server-side integration code. It should not put service-auth, webhook secrets, checkout envelopes, buyer assertions, ticket scan tokens, or fulfillment mutations into browser components.
Browser
- Shows app UI
- Calls your backend
- Follows ATM checkout URL
App backend
- Mints app service-auth
- Creates checkout
- Verifies events
- Fulfills orders
ATM
- Owns hosted checkout
- Tracks payment state
- Sends app events
- Coordinates proofs and tickets
App database
- Stores app order ids
- Tracks fulfillment state
- Deduplicates delivery ids
- Stores ATM payment ids
Environment variables
Keep environment names boring and explicit. Agents can wire local examples faster when the variable names match the docs.
| ATM_APP_DID | Your app DID. Used as the app service-auth issuer. |
|---|---|
| ATM_APP_SERVICE_AUDIENCE | Usually did:plc:a54sdlhmv7xklga67xamqfyq#AttestedNetwork. |
| ATM_BASE_URL | https://checkout.atmosphere.money for production or local ATM during development. |
| ATM_WEBHOOK_SECRET | Environment-scoped signing secret from the ATM app dashboard. |
| ATM_WEBHOOK_PREVIOUS_SECRET | Optional previous secret during rotation. |
Prompt checklist
A good agent prompt should include the integration outcome and the test that proves it. This keeps the work scoped and reviewable.
Read https://atmosphere.money/llms.txt first.
Use @atmosphere-money/app-node from the backend only.
Add a checkout route for this app order model: <describe order>.
Call getPayoutStatus before initiatePayment.
Store the ATM payment token/id with the app order.
Add an ATM webhook route using createNextWebhookRoute or createNodeWebhookHandler.
Deduplicate by ATM delivery id before fulfillment.
Add tests using @atmosphere-money/testing fixtures.
Do not expose ATM_WEBHOOK_SECRET, service-auth, or checkout envelopes to browser code.Webhook test loop
The fastest local loop is fixture first, dashboard event second, full sandbox checkout third.
- 01
Fixture test
Use @atmosphere-money/testing to create a signed payment.completed request.
- 02
Route check
Verify your handler rejects bad signatures and ignores duplicate delivery ids.
- 03
Dashboard event
Send a test event from the ATM app dashboard once your receiver URL exists.
- 04
Sandbox checkout
Run a test checkout and fulfill only from ATM event truth.
Common mistakes
- Building atm.checkout.v1 envelopes in browser code.
- Fulfilling from the checkout return page before a verified ATM event arrives.
- Parsing webhook JSON before preserving the exact raw request body.
- Reusing one service-auth JWT across multiple XRPC methods.
- Treating a buyer DID hint as a payer OAuth grant.
- Letting test and live webhook secrets share the same receiver state.