# checkouts.md

> checkouts.md is an open format and playbook that lets a coding agent or app builder add a working checkout to a project from one line: "Read checkouts.md and add a checkout to this app." The agent connects to the person's Railbed account with one approval (keys never pass through the chat), wires a server-side checkout and a signed webhook, proves it in Test mode, goes Live, and leaves a CHECKOUTS.md file at the project root that records how the project takes money. Railbed is the default provider: buyers pay by card, and every sale settles to a wallet the business controls.

The rules every agent follows:

- R1 Secrets never enter chat, logs or git. Only their names go in CHECKOUTS.md.
- R2 Paid means a verified signed webhook, then a re-read of the payment by id. Never the redirect back.
- R3 Amounts are decimal strings in the currency's units, like `"49.00"`.
- R4 Test before Live, and record the evidence.
- R5 Ask the person only for the account and the approval. Everything else is the agent's job.

## Start here

- [checkouts.md](https://checkouts.md/index.md): what this is, the six steps, the rules and what to tell the person
- [Playbook](https://checkouts.md/playbook.md): the complete procedure, with every request, command, error code and fix
- [CHECKOUTS.md format](https://checkouts.md/spec.md): version 0.1, its fields, sections and rules, and what a provider must offer
- [CHECKOUTS.md template](https://checkouts.md/templates/CHECKOUTS.md): the blank file to copy to a project's root

## Recipes

- [Next.js](https://checkouts.md/recipes/nextjs.md): App Router route handlers, PostgreSQL, Vercel
- [Express](https://checkouts.md/recipes/express.md): Node.js with Express and PostgreSQL
- [Cloudflare Workers](https://checkouts.md/recipes/cloudflare-workers.md): a Worker with D1 and static assets, Web Crypto verification
- [Supabase](https://checkouts.md/recipes/supabase.md): Edge Functions in Deno and a SQL function that applies payments atomically
- [Laravel](https://checkouts.md/recipes/laravel.md): controllers, Eloquent and a CSRF-exempt webhook
- [Django](https://checkouts.md/recipes/django.md): views, models and a standard-library API client
- [Rails](https://checkouts.md/recipes/rails.md): controllers, Active Record and net/http
- [Static site](https://checkouts.md/recipes/html.md): a hosted checkout page with no server, or a Pay button and two small functions
- [Lovable](https://checkouts.md/recipes/lovable.md): Supabase Edge Functions, secrets through Lovable's form, the prompt to paste
- [Bolt](https://checkouts.md/recipes/bolt.md): Supabase Edge Functions or the deploy host's functions, the prompt to paste
- [Replit](https://checkouts.md/recipes/replit.md): the Express recipe on Replit, Secrets and deployments
- [v0](https://checkouts.md/recipes/v0.md): the Next.js recipe on Vercel, environment variables per environment

## Tools

- [Skill](https://checkouts.md/skill/SKILL.md): the installable skill for coding agents, also written by `npx checkouts.md skill`
- [Connect API](https://checkouts.md/playbook.md#32-with-http-when-npx-cant-run): `POST https://checkouts.md/api/connect` and `POST https://checkouts.md/api/connect/token`, a device-approval flow for agents that can't run `npx checkouts.md login`

## Railbed

- [Railbed API docs for agents](https://railbed.com/docs/llms.txt): the full API reference, every page as Markdown
- [Checkout sessions](https://railbed.com/docs/api/checkout-sessions.md): every field, idempotency, orders and customers
- [Webhooks](https://railbed.com/docs/webhooks.md) and [signatures](https://railbed.com/docs/webhooks/signatures.md): events, retries, verification in six languages, a test vector
- [Errors](https://railbed.com/docs/api/errors.md): every error code
- [Sign up](https://app.railbed.io/signup): create the account the person needs

## Optional

- [Everything in one file](https://checkouts.md/llms-full.txt): every file above, concatenated