# Build with AI agents

> Everything in these docs is available to AI assistants and coding agents: llms.txt, a Markdown copy of every page, a structured index, and WebMCP tools on railbed.io and in the dashboard.

Source: https://railbed.io/docs/agents/ · Updated: 2026-09-26 · Railbed by DeepWork developer docs

## Give your assistant the docs

Point your coding assistant at one of these, depending on how much context it can take:

| Resource | What it is |
|---|---|
| [/docs/llms.txt](https://railbed.io/docs/llms.txt) | A summary of the API and its rules, with a link to every page. Start here |
| [/docs/llms-full.txt](https://railbed.io/docs/llms-full.txt) | Every docs page in one Markdown file |
| `/docs/<page>.md` | Any page as Markdown: add `.md` to its path, as in [/docs/quickstart.md](https://railbed.io/docs/quickstart.md). The overview is [/docs/index.md](https://railbed.io/docs/index.md) |
| [/agents/docs.json](https://railbed.io/agents/docs.json) | A structured index: every page, section and endpoint, with links |

Each page also has **Copy page for AI** in its sidebar, which copies the page's Markdown for pasting into a chat.

A prompt that works well:

```text
Read https://railbed.io/docs/llms.txt and the pages it links to that you need.
Then add Railbed card checkout to this app: create a checkout session on the server
when the user clicks Buy, redirect to its url, and fulfil the order from a verified
payment.paid webhook. Use my test key from RAILBED_SECRET_KEY and my webhook secret
from RAILBED_WEBHOOK_SECRET. Deduplicate on the event id.
```

> [!IMPORTANT]
> Keep secret keys and webhook secrets out of prompts, chats and code. Put them in your server's environment and let the assistant refer to them by name.

## Rules worth giving an agent

These are the mistakes that matter most in a payments integration. They're in `llms.txt` too.

- Call the API only from a server, with the key in an environment variable. There is no publishable key.
- Fulfil only when a payment is `paid`, confirmed by a verified webhook or `GET /v1/payments/:id`. Never from the buyer's return to `success_url`.
- Verify webhook signatures against the raw body, and deduplicate on the event `id`.
- Send an `Idempotency-Key` with every create.
- Treat `held` as not paid, and `expired` as possibly paid later.
- Start in Test mode (`rb_test_…` keys) and [simulate outcomes](https://railbed.io/docs/testing.md); no money moves.

## WebMCP tools

[WebMCP](https://webmachinelearning.github.io/webmcp/) lets a web page offer tools to an AI agent working in the visitor's browser, so the agent can act through the page's own logic instead of reading the screen. Railbed's pages offer tools in browsers that support it; elsewhere nothing changes.

### On railbed.io and these docs

Every page on railbed.io, including these docs, offers tools for learning about Railbed and building with it. All are read-only except the two that open signup or login.

| Tool | What it does |
|---|---|
| `railbed_docs_search` | Search the developer docs; returns the best matching sections with links |
| `railbed_docs_read` | A docs page, or one section of it, as Markdown |
| `railbed_api_reference` | Every API endpoint with its method, path and reference link, plus the base URL and the rules for authentication, idempotency, money and errors |
| `railbed_webhook_reference` | The webhook event types, when each is sent, the signature scheme and the retry schedule |
| `railbed_code_samples` | The docs' code examples, filtered by topic and language |
| `railbed_overview`, `railbed_faq`, `railbed_search`, `railbed_read_page`, `railbed_contact` | What Railbed is, the FAQ, and the company and legal pages |
| `railbed_start_signup`, `railbed_open_login` | Take the visitor to signup (email optionally filled in) or login. Nothing is submitted for them |

### In the dashboard

When a merchant is signed in, the **Developers** and **Integrations** pages offer tools that work on their account, in the mode the dashboard is in (Test or Live). They run with the merchant's own session, in their browser, so an agent can do only what the merchant could.

| Tool | Page | What it does |
|---|---|---|
| `railbed_developer_status` | Developers | The mode, the setup steps done so far, and a summary of keys and endpoints |
| `railbed_list_api_keys` | Developers | The keys, masked (`rb_test_••••••••3f9a`), with when each was created and last used |
| `railbed_list_webhook_endpoints` | Developers | Endpoints with their addresses, labels, events and latest delivery. Signing secrets are never included |
| `railbed_list_webhook_deliveries` | Developers | An endpoint's recent deliveries: status, attempts, your server's answer and, if asked, the body sent |
| `railbed_send_test_webhook` | Developers | Send a signed test event to an endpoint and report how it answered. Test endpoints take any event type; Live endpoints take `ping` only |
| `railbed_prepare_api_key` | Developers | Open **Create key** with a name filled in. The merchant creates it; the secret is shown only to them |
| `railbed_prepare_webhook_endpoint` | Developers | Open **Add endpoint** with the address, description and events filled in, for the merchant to review and save |
| `railbed_open_webhook_deliveries` | Developers | Open an endpoint's delivery log, optionally filtered to failed or retrying deliveries, so the merchant can resend |
| `railbed_list_integrations` | Integrations | The ways to take payments (links, checkouts, the API, store plugins), their status and where to set each up |
| `railbed_list_card_providers` | Integrations | The card providers Railbed routes to, with their status and minimum amounts (in Test mode, the fixed test list) |

Some things are deliberately left to the merchant. Tools never return a secret key or a signing secret, and they never create or revoke keys, roll secrets, remove endpoints or resend real events: those open the dashboard's own dialog for the merchant to confirm, or aren't offered at all.

> [!NOTE]
> Content returned by the delivery log includes data your buyers typed, such as their email, and your server's answers. Agents receive it marked as untrusted content.