> Toden documentation. For the full index fetch /llms.txt. Every page is available as Markdown by appending .md to its URL. Identity verification uses /api/kyc, Risk Intelligence uses /api/v1; they are separate contracts with different error shapes. Never invent an endpoint, field or enum value: read the API reference page for the operation first. # Integrate with an AI agent > How to point Claude Code, Cursor, Codex or another coding agent at Toden's machine-readable documentation and get a correct integration. A coding agent builds a good Toden integration when it reads the real contracts and knows the handful of rules that are easy to get wrong. This page gives it both. ## Works with the agent you already use #### [Claude Code](/get-started/ai/integration-prompt) Paste the integration prompt. Every page also opens in Claude from the button at the top. #### [Cursor](/get-started/ai/machine-readable) Add this site's `llms.txt` as a docs source, then paste the prompt. #### [ChatGPT and Codex](/get-started/ai/machine-readable) Give it the OpenAPI contracts and the prompt. Any other agent that can read a web page and your repository works the same way. ## The three-step setup ### Point the agent at the index Give it `/llms.txt` on this site. It lists every guide and API reference page with a one-line description, and each entry links to a Markdown version. ### Give it the contract for the API you are using | You are building | Contract | | -------------------------------------------------- | ----------------------------------------------------------- | | Identity verification, sessions, one-off checks | Identity verification OpenAPI (`/api/kyc`, `/api/identity`) | | Risk decisions, screening, monitoring, Travel Rule | Risk Intelligence OpenAPI (`/api/v1`) | Both are linked from [Machine-readable docs](/get-started/ai/machine-readable). ### Paste the integration prompt The [integration prompt](/get-started/ai/integration-prompt) states the rules below in a form an agent follows, and asks it to prove the result in Sandbox. ## Rules an agent must not get wrong These are the mistakes we see most often in generated integrations. #### Keys: publishable in clients, secret on the server A publishable key (`pk_`) can start a verification and read minimal status. A secret key (`sk_`) reads identity data and calls all of `/api/v1`. A secret key must never appear in browser or mobile code, in a prompt, or in a repository. Read keys from environment variables. #### Two contracts with different error shapes `/api/kyc` and `/api/identity` return `{ "error": "code", "message": "..." }`. `/api/v1` returns `{ "error": { "type", "code", "message", "request_id" } }`. Code written for one will not parse the other. #### Environments The key prefix names the environment (`_test_` or `_live_`). Risk Intelligence also has a separate Sandbox host, `https://sandbox-api.toden.co`. Sandbox identity verification accepts only published test IDs. #### Verification results are asynchronous Creating a session or a verification returns an ID, not a decision. The SDK's `onSubmit` means submitted. The outcome arrives by webhook or a status read. Never grant access from a client callback. #### Branch on status, and handle every value Use the top-line `status`. `in_review`, `processing`, `error`, `abandoned` and `expired` are not approvals and are not declines. Include a default branch: new values can be added. #### Idempotency Identity: send a unique `metadata.requestId`. Risk Intelligence: send an `Idempotency-Key` header where the endpoint requires it; transactions and activities use `externalActivityId`. On a timeout, resend the same body and key. #### Webhooks Verify `X-Myaza-Signature-V2` over the raw request bytes, reject timestamps outside the replay window, store the event `id` to ignore repeats, and return `2xx` quickly. Read current state from the API before acting, because order is not guaranteed. #### An error is never an approval A failed or timed-out risk decision is not `ALLOW`. A verification with `status: "error"` is not a decline. Model both explicitly. #### Names that look out of date are correct Toden was previously Myaza Trust. Header names (`X-Myaza-Signature-V2`, `Myaza-Version`) and packages (`@myazahq/kyc-sdk-react`) keep that name. Do not rename them. ## What is and is not available So that an agent does not build on something that does not exist: | Item | Status | | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | React web SDK `@myazahq/kyc-sdk-react` | Published on npm | | React Native SDK `@myazahq/kyc-sdk-react-native` | Published on npm | | Flutter SDK `myaza_kyc_sdk_flutter` | Published on pub.dev | | Node.js server SDK for Risk Intelligence | **Not yet published.** Call the REST API directly. | | Server SDKs in other languages | Not available. Call the REST API directly. | | MCP server | A documentation server is available: it searches these docs and runs no API calls. One that works with your account is planned. See [MCP server](/get-started/ai/mcp-server). | ## Agent skills Each skill is a short Markdown brief for one product: what to read, the rules that protect customers, and the tests that prove the work. Save the Markdown version of a skill page into your agent's skills folder (`.claude/skills/toden-/SKILL.md` for Claude Code, `.agents/skills/toden-/SKILL.md` for Codex). Skills install nothing, ask for no credentials and run no commands. The skills are listed under **Agent skills** in the sidebar. ## Keep a person in the loop An agent should build and test in Sandbox. A person should approve anything that changes what real customers experience: publishing a workflow or policy, switching to live keys, and changing a decision rule.