Integrate with an AI agent
A coding agent builds a good Toden integration when it reads the real contracts and knows the handful of rules that are easy to get wrong. This page gives it both.
Works with the agent you already use
Any other agent that can read a web page and your repository works the same way.
The three-step setup
Point the agent at the index
Give it /llms.txt on this site. It lists every guide and API reference page with a one-line description, and each entry links to a Markdown version.
Paste the integration prompt
The integration prompt states the rules below in a form an agent follows, and asks it to prove the result in Sandbox.
Rules an agent must not get wrong
These are the mistakes we see most often in generated integrations.
Keys: publishable in clients, secret on the server
A publishable key (pk_) can start a verification and read minimal status. A secret key (sk_) reads identity data and calls all of /api/v1. A secret key must never appear in browser or mobile code, in a prompt, or in a repository. Read keys from environment variables.
Two contracts with different error shapes
/api/kyc and /api/identity return { "error": "code", "message": "..." }. /api/v1 returns { "error": { "type", "code", "message", "request_id" } }. Code written for one will not parse the other.
Environments
The key prefix names the environment (_test_ or _live_). Risk Intelligence also has a separate Sandbox host, https://sandbox-api.toden.co. Sandbox identity verification accepts only published test IDs.
Verification results are asynchronous
Creating a session or a verification returns an ID, not a decision. The SDK’s onSubmit means submitted. The outcome arrives by webhook or a status read. Never grant access from a client callback.
Branch on status, and handle every value
Use the top-line status. in_review, processing, error, abandoned and expired are not approvals and are not declines. Include a default branch: new values can be added.
Idempotency
Identity: send a unique metadata.requestId. Risk Intelligence: send an Idempotency-Key header where the endpoint requires it; transactions and activities use externalActivityId. On a timeout, resend the same body and key.
Webhooks
Verify X-Myaza-Signature-V2 over the raw request bytes, reject timestamps outside the replay window, store the event id to ignore repeats, and return 2xx quickly. Read current state from the API before acting, because order is not guaranteed.
An error is never an approval
A failed or timed-out risk decision is not ALLOW. A verification with status: "error" is not a decline. Model both explicitly.
Names that look out of date are correct
Toden was previously Myaza Trust. Header names (X-Myaza-Signature-V2, Myaza-Version) and packages (@myazahq/kyc-sdk-react) keep that name. Do not rename them.
What is and is not available
So that an agent does not build on something that does not exist:
Agent skills
Each skill is a short Markdown brief for one product: what to read, the rules that protect customers, and the tests that prove the work. Save the Markdown version of a skill page into your agent’s skills folder (.claude/skills/toden-<product>/SKILL.md for Claude Code, .agents/skills/toden-<product>/SKILL.md for Codex). Skills install nothing, ask for no credentials and run no commands.
The skills are listed under Agent skills in the sidebar.
Keep a person in the loop
An agent should build and test in Sandbox. A person should approve anything that changes what real customers experience: publishing a workflow or policy, switching to live keys, and changing a decision rule.