> This page is for version 🇦🇺 AU (default).
> For other versions, use one of these documentation indexes:
> - 🇦🇺 AU (default): https://docs.humanapproved.com/au/llms.txt
> - 🇬🇧 UK: https://docs.humanapproved.com/uk/llms.txt
> - 🇺🇸 US: https://docs.humanapproved.com/us/llms.txt

> This is HumanApproved's documentation, as Markdown for AI agents. /llms.txt lists every page; /llms-full.txt has them all. If you're helping someone integrate HumanApproved, start with /guides/ai-coding-agents.

# Integrate with an AI coding agent

> How to give an AI coding agent HumanApproved's docs as Markdown, a ready-to-paste prompt for integrating HumanApproved into a checkout, and a checklist for reviewing its work.

These docs are published in forms a coding agent can read directly, so you can hand the integration to Claude Code, Cursor, GitHub Copilot or a similar tool and review what it produces.

## Give the agent the docs

| Source                             | What it is                                                                                         |
| ---------------------------------- | -------------------------------------------------------------------------------------------------- |
| [`/llms.txt`](/llms.txt)           | An index of every page, with a one-line description of each.                                       |
| [`/llms-full.txt`](/llms-full.txt) | Every page in one Markdown file. The best single thing to give an agent.                           |
| Any page + `.md`                   | Add `.md` to any page's address for that page as Markdown, for example `/guides/add-the-embed.md`. |

Each page also has buttons at the top: **Copy page** copies it as Markdown, and **Open in Claude**, **Open in ChatGPT** and **Open in Cursor** start a conversation with the page loaded.

## Paste this prompt

Open your coding agent in your checkout's code and paste the prompt below. Fill in the parts in square brackets first.

```text
Integrate HumanApproved into our insurance checkout. HumanApproved pauses a purchase when an AI
agent is buying and asks the customer to approve the purchase.

Before writing any code, read https://docs.humanapproved.com/llms-full.txt and follow it. Don't
guess at API fields, options or behaviour: if the docs don't cover something, ask me.

Our setup:
- Quote journey pages: [where the shared layout or template is]
- The step before payment: [the button, link or form that continues to payment, e.g. #continue-to-payment]
- Where the quote's values live in the browser: [e.g. our quote state or store]
- Where we bind the policy on the server: [file or service]
- The product's published fields: [paste them from the portal's Fields page]

Do this:
1. Load the embed script on every page of the quote journey, pinned to the version with its
   integrity hash and crossorigin="anonymous". I'll paste the exact tag from the portal's Embed
   page: use it as given.
2. In a separate script file served from our site (not an inline script), call protect with our
   publishable key, our quote reference, a "before" selector for the step before payment, and a
   quoteDetails function returning { quote, mobile }.
3. Map our quote's values to the product's published fields exactly: same keys and nesting,
   dates as YYYY-MM-DD, money as { amount, currency }. mobile is the customer's own mobile.
   Keep quoteDetails fast and free of side effects.
4. Send the review ID from onResult "approved" to our server and store it with the quote.
5. At bind, on the server, call GET https://au.humanapproved.com/api/v1/server/reviews/{reviewId}
   with the secret key, and only bind when status is "approved", quoteRef matches the quote being
   bound and env is "live" in production. Bind the quote we hold on the server, not details sent
   from the browser.
6. Add https://cdn.beopen.com to script-src and https://au.humanapproved.com to connect-src and
   img-src in our Content Security Policy.
7. Use test keys while developing. Read keys from environment variables:
   HUMANAPPROVED_PUBLISHABLE_KEY for the browser and HUMANAPPROVED_SECRET_KEY for the server.

Rules:
- Never commit keys to source control, including in examples, tests or .env files that are tracked.
- Never put the secret key in browser code, a client bundle or anything sent to the browser.
- Don't set baseUrl: the embed works out the host from the key.
- Don't change how the checkout behaves for customers who aren't paused.

When you're done, list every file you changed and how to test it with a test key.
```

## Review the agent's work

Before you merge, check:

* [ ] The embed `<script>` is on **every page** of the quote journey, not only the payment page, with the version and `integrity` hash from the portal's **Embed** page and `crossorigin="anonymous"`.
* [ ] `protect` is called from a file on your site, not an inline script.
* [ ] `before` matches the element customers click or submit to continue to payment.
* [ ] `quoteDetails` returns every required field with the product's exact keys, nesting and types, reads values from your quote state, and has no side effects.
* [ ] `mobile` is the customer's own mobile number.
* [ ] The secret key appears only in server code, read from an environment variable or secrets manager. Search the client bundle for `sk_` to be sure.
* [ ] No key is committed: search the diff for `pk_live_`, `pk_test_`, `sk_live_` and `sk_test_`.
* [ ] Your server refuses to bind unless the review is `approved`, its `quoteRef` matches and, in production, its `env` is `live`.
* [ ] Your Content Security Policy allows `https://cdn.beopen.com` in `script-src` and your region's address in `connect-src` and `img-src`.
* [ ] There's no `baseUrl`.
* [ ] You've run the [test checklist](/guides/test-and-go-live#test-checklist) with a test key, including the pause panel with the product set to **Every purchase**.

## Related

* [Add the embed](/guides/add-the-embed)
* [Verify on your server](/guides/verify-on-your-server)
* [Test and go live](/guides/test-and-go-live)