Checkout, payments and refunds over one HTTP API.

{
  "id": "evt_…",
  "type": "checkout.session.completed",
  "mode": "test",
  "created_at": "…",
  "data": {
    "checkout_session": {
      "id": "cs_test_…",
      "client_reference_id": "order-1042",
      "amount": 2400,
      "currency": "USD"
    },
    "payment": { "id": "pay_…", "status": "succeeded" }
  }
}

import crypto from "node:crypto";

// raw: the request body exactly as received
function verify(raw, header, secret) {
  const p = Object.fromEntries(header.split(",").map((s) => s.split("=")));
  const expected = crypto.createHmac("sha256", secret)
    .update(`${p.t}.${raw}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(p.t)) < 300;
  return fresh && p.v1?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(p.v1), Buffer.from(expected));
}

Shortened. Reject events with an old timestamp to stop replays.

{
  "mcpServers": {
    "binkly": {
      "command": "npx",
      "args": ["-y", "@binkly/agent-mcp"],
      "env": { "BINKLY_AGENT_KEY": "agk_test_…" }
    }
  }
}

# Ask the customer to approve paying a checkout
curl https://api.binkly.tech/v1/agent/purchases \
  -H "Authorization: Bearer agk_test_…" \
  -H "Content-Type: application/json" \
  -d '{ "checkout": "cs_test_…", "note": "The coffee beans you buy every month" }'

# Then follow it until "succeeded" (or declined, expired…)
curl https://api.binkly.tech/v1/agent/purchases/agp_… \
  -H "Authorization: Bearer agk_test_…"

Over a limit, the answer says which one (over_limit, over_budget…) so the assistant can tell the customer.