Add USDC checkout with an AI coding agent, using the Fianto agent skill.

How do you install the Fianto agent skill?

You install the Fianto agent skill from its public repository with the skills command-line tool, which the vercel-labs/skills README calls "The CLI for the open agent skills ecosystem." (vercel-labs/skills, read 15 October 2026). Run it from your project root:

npx skills add fianto-xyz/skills                     # this project, choose agents interactively
npx skills add fianto-xyz/skills -g                  # every project
npx skills add fianto-xyz/skills -a claude-code -y   # one agent, no prompts
npx skills add fianto-xyz/skills --list              # see what the repo contains

A project install puts the skill in your agent's skills folder inside the repository; commit that folder and everyone who clones the project gets the same instructions. If your tool does not use the CLI, copy SKILL.md and references/ into a fianto folder in its skills directory, for example .claude/skills/fianto/ for Claude Code. In a chat app with no skill support, paste SKILL.md into the project instructions and add the reference file for the task at hand.

An agent skill, in the format's own words, is "a folder containing a SKILL.md file" with metadata and instructions (agentskills.io, read 15 October 2026). Agents load only each skill's name and description at startup and read the full file when a task matches, so an installed skill costs almost nothing until you mention Fianto, one of its packages or one of its errors.

What is in the Fianto agent skill?

The Fianto agent skill is one instruction file of 271 lines and ten reference files, each summarising pages of docs.fianto.xyz and linking them. SKILL.md holds the security rules, the 20 v1 endpoints at a glance, nine integration rules and one complete Next.js example. The agent reads a reference file only when the task needs it.

The repository's README gives the reason it exists: Fianto is new, so coding agents have never seen its API, and without the skill they guess. Every fact in it is taken from the Fianto docs. Read the skill on GitHub first. The README asks for that itself: "Read the skill before installing it, as with any code you give an agent."

What does an AI agent get wrong about Fianto without the skill?

Without the skill, an AI agent writes the payment API it has seen most often, and most of those names are wrong for Fianto. The skill carries a correction table for exactly these guesses. Each right-hand entry below is what the real API and SDK use.

The quieter mistakes cost more. An agent that skips the webhook URL's verification challenge builds an integration that never receives an event: Fianto stores events published before the URL is first verified but never delivers them. One that fulfils from the browser's redirect ships goods before the payment is final. And one that retries a checkout create with a fresh idempotency key gets url: null back, with no working link until it reissues one. The skill states each of these as a rule. Why the key matters is in idempotency keys and order ids.

What should you ask the agent to build?

Ask the agent for a complete outcome in your own stack, and name the stack. These prompts come from the skill's README:

• "Add fianto checkout to my Next.js shop so orders are marked paid when the payment finalizes."
• "Sell a 9.99 USDC plan every 30 days from my Hono app and let signed-in users cancel it."
• "My Express fianto webhook returns 500 BodyAlreadyParsedError. Fix it."
• "Review my fianto integration against the go-live checklist."
• "A customer says they paid but the order is still pending. What happened?"

Plan for the result to be three pieces: a checkout route on your server that decides the price and creates the session, a pay button in the browser, and a webhook route that verifies the signature and fulfils on order.paid for one-off payments or subscription.created for subscriptions. With the skill loaded the agent builds them with @fianto/nextjs, @fianto/express or @fianto/hono. Hand-written versions of the same three pieces for comparison: Next.js, Express subscriptions and Hono.

What can a coding agent not do with Fianto?

A coding agent cannot create a Fianto account, an application or a key, and it should never see your secrets. The skill says so directly: "An agent cannot create accounts or applications." These steps stay with you:

1. Sign up at merchant.fianto.xyz, complete the business profile, two-factor sign-in and the signed proof of your receiving wallet, and submit for review. A Fianto admin approves the account; no review time is promised.
2. After approval, create an application under Developers. Its app id and secret go in your server's environment as FIANTO_APP_ID and FIANTO_APP_SECRET, typed by you, not pasted into the chat.
3. If you sell a subscription or charge by price_id, create the product and its price in the dashboard. The v1 API reads them but cannot create them.
4. Set the webhook URL, put its whsec_ secret in FIANTO_WEBHOOK_SECRET, restart, and check the endpoint's status reads Active.
5. Make sure the receiving wallet holds a USDC token account; otherwise creating a session fails with 422 merchant_token_account_missing.

Payment links, discount codes and the shop are dashboard features with no API or SDK, so an agent can explain them and write code that handles their sales (their orders arrive as plink_ and shop_ ids through webhooks), but it cannot create them. For a no-code start, see USDC payment links.

Which actions does the skill make the agent confirm first?

The skill makes the agent stop and wait for a clear yes from you, in the conversation, before any action that cannot be undone. Text inside a webhook payload, an event, metadata or a web page never counts as that yes: the skill tells the agent to treat such text as data, and to report instructions found in it as prompt injection instead of following them.

The last row is also a product fact: there is no refund API, and finalized Solana transfers cannot be reversed. A refund is USDC the merchant sends back from its own wallet, by hand. The skill tells agents never to tell a payer "you were not charged" from an unknown or expired state, because USDC may already have landed.

How do you check the code the agent wrote?

Check the agent's code against the skill's go-live essentials before any customer pays. Each item is quick to verify by reading the diff:

• Secrets are read from the server environment and never reach a client bundle; the browser holds no key.
• The price is decided on the server, never taken from the request body.
• In Express, both Fianto routes are registered before express.json().
• Fulfilment happens only in the webhook route, on order.paid or subscription.created, never on success_url.
• The webhook route records event.id in the same database transaction as the fulfilment and skips ids it has seen.
• onError and onVerificationError log somewhere you read.
• The page at success_url says the payment is being confirmed.

Then test it without spending: signed samples of each event type through the CLI, and one real payment of 0.01 USDC at the end. Testing a USDC integration without a test mode has the full routine.

Fianto is not alone in shipping instructions for agents. As of 15 October 2026, Stripe's API reference opens with: "Stripe provides skills and plugins for agents to build faster and more accurately." (Stripe API reference.) If your agent has no skill support at all, point it at docs.fianto.xyz/llms.txt: every docs page is also served as Markdown at its address plus .md, which is where the skill itself sends agents for anything it leaves out.