Skip to main content
AI coding assistants can help scaffold a FossaPay integration, explain endpoint contracts, and review webhook or reconciliation logic. Treat generated code as a draft: verify it against this documentation and test it with controlled production operations before handling regular volume.
Never paste a production API key, webhook secret, customer record, bank account, or unredacted production log into an AI prompt.

Provide authoritative context

When asking an assistant for implementation help, include links or copied excerpts from the relevant FossaPay documentation pages. State these platform constraints explicitly:
  • the base URL is https://api-production.fossapay.com/api/v1;
  • FossaPay currently has no staging or sandbox environment;
  • API keys must remain on trusted server infrastructure;
  • external customers must have type: "individual";
  • Solana is the only supported stablecoin network;
  • checkout and master-wallet payout creation require idempotency keys; and
  • webhook signatures cover exactly JSON.stringify(body.data).

Prompt template

Useful review tasks

Ask an assistant to:
  • generate a typed HTTP client from a specific endpoint contract;
  • add status-aware error handling to an existing integration;
  • review whether secrets can reach client-side code or logs;
  • implement webhook signature verification and eventId deduplication;
  • check idempotency behavior for checkout or payout creation;
  • add decimal-safe money handling;
  • write contract tests from documented request and response examples; or
  • identify places where an ambiguous timeout could create a duplicate operation.

Complete server-side example

This example creates an individual customer and parses the HTTP response before using the returned UUID.
The code runs only on a trusted backend. It does not expose credentials to a browser or mobile application.

Validate generated code

Before accepting AI-generated integration code, confirm that it:
  • uses an endpoint and field names present in the API Reference;
  • sends Content-Type only when a JSON body is present;
  • never logs authentication or webhook secrets;
  • checks response.ok before consuming a success payload;
  • stores FossaPay IDs and your references;
  • uses one stable idempotency key for each checkout or payout retry;
  • deduplicates webhooks with a persistent unique constraint on eventId;
  • separates webhook delivery status from financial transaction status;
  • uses decimal-safe arithmetic; and
  • contains no real customer identity or production account data in fixtures.

Choose the correct documentation

If generated code conflicts with the FossaPay documentation or an observed API response, stop and reconcile the discrepancy before deploying it.