3 posts tagged with "api"

Suppose an agent has been asked to buy a token, and your service can do that. How does it find out?

Not from your homepage — it cannot reliably read a JavaScript app, and marketing copy does not tell it which endpoint to call. Not from your docs site, which assumes a reader who already decided to integrate. If discovery depends on a human having read something and then written code, your service is not agent-accessible; it is human-accessible with an API attached.

An AI agent trying to use a paid API hits a wall that has nothing to do with intelligence. It cannot sign up.

Signup assumes a person: an email to confirm, a card with a billing address, sometimes a captcha or an SMS. An agent has none of that. What it can have is a wallet — and if a service is willing to be paid by wallet, the entire onboarding problem collapses into a single HTTP exchange.

If you have integrated one exchange API you have integrated most of them. The signing scheme is near-universal: a key id, a secret, an HMAC over some canonical form of the request.

What varies — and what almost no documentation explains — is exactly which bytes go into the signature, what else the server checks, and in what order. Those details are the security. The HMAC is the easy part.