Skip to navigation
Guides

Integrate with an AI coding agent

Point Claude Code, Cursor, GitHub Copilot or another coding agent at these docs and have it add HumanApproved to your checkout.

These docs are published in forms a coding agent can read directly, so you can hand the integration to Claude Code, Cursor, GitHub Copilot or a similar tool and review what it produces.

Give the agent the docs

SourceWhat it is
/llms.txtAn index of every page, with a one-line description of each.
/llms-full.txtEvery page in one Markdown file. The best single thing to give an agent.
Any page + .mdAdd .md to any page’s address for that page as Markdown, for example /guides/add-the-embed.md.

Each page also has buttons at the top: Copy page copies it as Markdown, and Open in Claude, Open in ChatGPT and Open in Cursor start a conversation with the page loaded.

Paste this prompt

Open your coding agent in your checkout’s code and paste the prompt below. Fill in the parts in square brackets first.

Integrate HumanApproved into our insurance checkout. HumanApproved pauses a purchase when an AI
agent is buying and asks the customer to approve the purchase.
Before writing any code, read https://docs.humanapproved.com/uk/llms-full.txt and follow it. Don't
guess at API fields, options or behaviour: if the docs don't cover something, ask me.
Our setup:
- Quote journey pages: [where the shared layout or template is]
- The step before payment: [the button, link or form that continues to payment, e.g. #continue-to-payment]
- Where the quote's values live in the browser: [e.g. our quote state or store]
- Where we bind the policy on the server: [file or service]
- The product's published fields: [paste them from the portal's Fields page]
Do this:
1. Load the embed script on every page of the quote journey, pinned to the version with its
   integrity hash and crossorigin="anonymous". I'll paste the exact tag from the portal's Embed
   page: use it as given.
2. In a separate script file served from our site (not an inline script), call protect with our
   publishable key, our quote reference, a "before" selector for the step before payment, and a
   quoteDetails function returning { quote, mobile }.
3. Map our quote's values to the product's published fields exactly: same keys and nesting,
   dates as YYYY-MM-DD, money as { amount, currency }. mobile is the customer's own mobile.
   Keep quoteDetails fast and free of side effects.
4. Send the review ID from onResult "approved" to our server and store it with the quote.
5. At bind, on the server, call GET https://uk.humanapproved.com/api/v1/server/reviews/{reviewId}
   with the secret key, and only bind when status is "approved", quoteRef matches the quote being
   bound and env is "live" in production. Bind the quote we hold on the server, not details sent
   from the browser.
6. Add https://cdn.beopen.com to script-src and https://uk.humanapproved.com to connect-src and
   img-src in our Content Security Policy.
7. Use test keys while developing. Read keys from environment variables:
   HUMANAPPROVED_PUBLISHABLE_KEY for the browser and HUMANAPPROVED_SECRET_KEY for the server.
Rules:
- Never commit keys to source control, including in examples, tests or .env files that are tracked.
- Never put the secret key in browser code, a client bundle or anything sent to the browser.
- Don't set baseUrl: the embed works out the host from the key.
- Don't change how the checkout behaves for customers who aren't paused.
When you're done, list every file you changed and how to test it with a test key.

Review the agent’s work

Before you merge, check:

  • The embed <script> is on every page of the quote journey, not only the payment page, with the version and integrity hash from the portal’s Embed page and crossorigin="anonymous".
  • protect is called from a file on your site, not an inline script.
  • before matches the element customers click or submit to continue to payment.
  • quoteDetails returns every required field with the product’s exact keys, nesting and types, reads values from your quote state, and has no side effects.
  • mobile is the customer’s own mobile number.
  • The secret key appears only in server code, read from an environment variable or secrets manager. Search the client bundle for sk_ to be sure.
  • No key is committed: search the diff for pk_live_, pk_test_, sk_live_ and sk_test_.
  • Your server refuses to bind unless the review is approved, its quoteRef matches and, in production, its env is live.
  • Your Content Security Policy allows https://cdn.beopen.com in script-src and your region’s address in connect-src and img-src.
  • There’s no baseUrl.
  • You’ve run the test checklist with a test key, including the pause panel with the product set to Every purchase.