surfpay.ai

Developers

Surfboard Payments developer resources

Everything needed to integrate Surfboard Payments, at predictable URLs, with nothing gated. Demo credentials are the only step that needs a person.

Quickstart

Six steps from nothing to a payment you have watched reach a terminal state.

  1. Hand the URL to your agent

    Any agent that can fetch a URL and run commands. It receives the whole brief, including the safety rules and the conventions that break first integrations.

    fetch https://surfpay.ai to add payments

  2. Or install the skills yourself

    Ten skills, a router plus one per integration flow, each bundling the developer guides it cites.

    npx -y skills add surfboardpayments/skills --skill '*' --yes

  3. Connect the documentation

    Hosted MCP over Streamable HTTP: 157 endpoints, 44 guides, and the webhook catalog, with nothing to install and no credentials.

    https://www.surfboardpayments.com/.well-known/mcp

  4. Get Demo credentials

    Yours to do, once. Issued immediately on signup, no sales call and no approval queue. Demo uses test cards and cannot move real money.

    https://developers.surfboardpayments.com/console/api-keys

  5. Build against the typed spec

    The payments API as OpenAPI 3.1: every documented operation with an operationId, typed parameters, and response schemas, ready to generate a client from.

    https://www.surfboardpayments.com/openapi/carbon.json

  6. Prove it in Demo

    Create an order, initiate a payment, poll until it reaches a terminal state. Do not call it done before you have seen a real response.

    status: completed

Every resource

All of it public, unauthenticated, and open to cross-origin requests.

Instructions for agents

Tools an agent can call

Specifications

The skills pack

Reference and accounts

Authentication and the sandbox

Nothing on this domain needs a key

Every endpoint listed above is public. There is no signup, no rate limit, and CORS is open, so a browser-based agent can call them directly.

The payments API does

Server-side calls to the Carbon API authenticate with three headers: API-KEY, API-SECRET, and MERCHANT-ID. Browser and mobile code uses a short-lived client auth token instead, which cannot perform administrative operations. The base URL is issued per account and differs between Demo and Live; read it from configuration rather than hard-coding a host you inferred from an example.

Demo is the sandbox

Demo credentials are issued immediately on signup at the Developer Portal, with no sales call and no approval queue. Demo runs on test cards. A real card used there by accident is voided automatically after 30 minutes: it is never captured and never settles.

Live is separate. It requires a signed contract, a certification call, and production credentials issued to a named person. An agent cannot provision it, and the instructions published here tell it not to try.

Webhooks

Payment state changes are delivered as notifications you subscribe to per merchant or store. The two guides that cover it are webhooks and notifications and notification subscriptions, and the surfboard-webhooks skill bundles both.