AllScale Checkout Skill Open standard · MIT

Integrate stablecoin checkout by talking to your AI agent.

A portable, agent-agnostic prompt that walks any AI coding agent through wiring AllScale Checkout into your app — credentials, signing, polling, webhooks. One Markdown file. No SDK.

Read and follow the instructions at allscale.io/skill

Works with any agent that reads a URL Server-side signing only Ships in minutes, not days

How it works

Three steps. One Markdown file.

You don't install anything globally. The skill is a single Markdown file your agent fetches and follows — verifying credentials, writing code for your stack, testing connectivity, debugging.

Paste the prompt

Drop one line into Claude Code, Cursor, Codex, or any agent. It fetches the guide and starts working in your repo.

> Read and follow the instructions at allscale.io/skill

Agent walks you through

It asks for your stack, writes signing code, verifies connectivity against the three test endpoints, and shows the canonical-string format if anything breaks.

GET /v1/test/ping 200
GET /v1/test/fail handled
POST /v1/test/post echo ok

Ship the checkout

Server creates the intent, returns a hosted checkout_url, polls for status, verifies the webhook. Done.

Orderorder_124

ChainBase · USDT

StatusConfirmed

Total received 5.0000USDT

What it covers

The full integration, end‑to‑end.

From key handling to webhook verification. The agent reads your stack and writes the right code for it — Next.js, Flask, Rails, Express, vanilla.

// 03 · request signing

HMAC-SHA256 request signing, done right.

Canonical strings joined by \n, body hashed from raw bytes (not re-serialized), Base64-encoded. The agent writes the utility for your language and reads the secret from env.

// canonical = METHOD \n PATH \n QUERY \n TS \n NONCE \n BODY_SHA256
const sig = hmacSHA256(secret, canonical).toBase64();
headers["X-Signature"] = `v1=${sig}`;

// 04 · connectivity

Tests three endpoints before you write a line of payment code.

Catches signature bugs early. If a 20002 shows up, the agent walks the debug checklist.

// 06 · status polling

Poll the intent until terminal.

CONFIRMED 20 ON_CHAIN 10 PAYING 2 TIMEOUT −5 FAILED −1

// 07 · webhooks

Webhook signatures verified with the prefix line.

The webhook canonical string starts with allscale:webhook:v1 — a common source of confusion. Skill enforces a 5-minute timestamp window, nonce replay protection, and timing-safe comparison.

// webhook canonical, line-by-line
"allscale:webhook:v1"
METHOD · PATH · QUERY · WEBHOOK_ID
TIMESTAMP · NONCE · BODY_SHA256

// 05 · enums

Integer enums — never string codes.

Send 1, not "USD".

USD1

EUR44

GBP48

CAD27

JPY72

SGD126

// 02 · your stack

Code for your framework, not boilerplate.

Next.js, Flask, Rails, Express, mobile, vanilla — the skill asks once and adapts every snippet to match.

Install

Pick your agent. Paste one line.

Each tool has its own way of consuming a prompt. The simplest path works everywhere; specific tools get a more native install.

Any AI coding agent — simplest, works everywhere

Paste this into your agent's chat. The agent fetches the file and starts the integration. Recommended for Aider, Continue, Cline, or anything else that can read a URL.

> Read and follow the instructions at allscale.io/skill

Claude Code — save as a slash command

Save the skill into .claude/commands/ so you can re-invoke it any time with /integrate-allscale.

> Read allscale.io/skill and save it to .claude/commands/integrate-allscale.md

# then, any time:
> /integrate-allscale

OpenAI Codex — pull it into project context

Download the guide into your repo so Codex picks it up alongside your AGENTS.md.

$ curl -L -o integrate-allscale.md https://allscale.io/skill

# in AGENTS.md:
When the user wants to integrate AllScale Checkout,
read and follow ./integrate-allscale.md.

Cursor — save as a project rule

Drop the guide into .cursor/rules/ and reference it in chat with @integrate-allscale.

$ mkdir -p .cursor/rules
$ curl -L -o .cursor/rules/integrate-allscale.mdc https://allscale.io/skill

# in chat:
> @integrate-allscale

Manual / offline

Pull the file down with curl, then open it in any agent and tell it to follow the instructions.

$ curl -L -O https://allscale.io/skill

Safety pledge

Built so the agent can't leak your secret.

The skill carries critical safety rules the agent must follow before writing a single credential to disk. It's spelled out in plain language at the top of the file.

Seven non-negotiables.

Hardcoded into the skill — every agent that follows it works under the same rules.

API Secret never touches source code Only ever written to a .env file — never any other file type.
Never logged, never echoed No generated code prints, logs, or returns the secret in error messages.
.gitignore enforced before .env is written The agent checks .gitignore first and adds .env if missing.
Warns if .env is staged in git Won't let a credential file slip into a commit unnoticed.
Signing only on the server Never generates code that signs requests in browser bundles or mobile clients.
Rate limiting on every checkout endpoint Defaults to 5 requests/minute per IP unless you override.
Server-side amount validation Client-sent amounts are bounded before being passed to the API.