> Documentation index: https://docs.sellhidden.com/llms.txt

# Build with AI

Source: https://docs.sellhidden.com/ai

Tell the assistant what you want. It reads these docs and writes the code with you.

## Prompt builder

Read https://docs.sellhidden.com/llms-full.txt. It is the complete documentation of the Hidden API in one file. Help me connect my Hidden store (sellhidden.com) to my own code. Ask me first what I want to build: show my products on my website, get a message when an order is paid, deliver from my own server, or manage my store from code. Ask which language I use. Then write the integration step by step. Base URL https://api.sellhidden.com/v1. Ask me for my API key before any call, keep it in an environment variable, never log it and never put it in a URL or a chat message. Send Idempotency-Key on every POST. Every call is live: there is no test mode.

## Files for AI tools

Every page is also Markdown: add `.md` to its address.

- **[hidden-api-docs.md](/llms-full.txt?download=1)** `https://docs.sellhidden.com/llms-full.txt`: Every page in one file. Give it to your AI assistant.
- **[llms.txt](/llms.txt)** `https://docs.sellhidden.com/llms.txt`: The index: one line per page with its Markdown address.
- **[hidden-openapi.json](/openapi.json)** `https://docs.sellhidden.com/openapi.json`: OpenAPI 3.1: every path, field and scope.
- **[hidden-postman.json](/postman.json)** `https://docs.sellhidden.com/postman.json`: Postman collection, one folder per group.

- hidden-api-docs.md: https://docs.sellhidden.com/llms-full.txt
- llms.txt: https://docs.sellhidden.com/llms.txt
- hidden-openapi.json: https://docs.sellhidden.com/openapi.json
- hidden-postman.json: https://docs.sellhidden.com/postman.json

## Rules for your coding tool

Save this file as `AGENTS.md` in your project, or wherever your tool reads its rules. Your tool then knows the Hidden API on every later task.

```md
# Hidden API: rules for coding tools

- Base URL https://api.sellhidden.com/v1. Public endpoints need no key. Authenticated endpoints take `Authorization: Bearer <key>`.
- Ask the user for their API key and store slug. Never print, log or commit the key; keep it in an environment variable.
- Send `Idempotency-Key` on every POST.
- Verify every webhook: HMAC-SHA256 of `${X-Hidden-Timestamp}.${rawBody}` with the endpoint secret, compared in constant time; reject timestamps older than 5 minutes; dedupe by X-Hidden-Delivery; answer 2xx within 15 seconds.
- There is no test mode: every call is live. Use a $0 product or a temporary key from the Try it panel to test.
- Orders are created by buyers at checkout; the API manages them afterwards.

## Endpoints

Base URL https://api.sellhidden.com/v1
Authorization: Bearer <key>

- Products: GET /products, POST /products, GET /products/{id}, PATCH /products/{id}, DELETE /products/{id}, GET /products/{id}/variations, POST /products/{id}/variations, GET /products/{id}/variations/{variationId}, PATCH /products/{id}/variations/{variationId}, DELETE /products/{id}/variations/{variationId}, GET /products/{id}/keys, POST /products/{id}/keys, DELETE /products/{id}/keys, POST /products/{id}/stock — scope products:read / products:write
- Categories: GET /categories, POST /categories, GET /categories/{id}, PATCH /categories/{id}, DELETE /categories/{id}, POST /categories/reorder — scope categories:read / categories:write
- Coupons: GET /coupons, POST /coupons, GET /coupons/{id}, PATCH /coupons/{id}, DELETE /coupons/{id} — scope coupons:read / coupons:write
- Orders: GET /orders, GET /orders/{id}, POST /orders/{id}/approve, POST /orders/{id}/reject, POST /orders/{id}/cancel, POST /orders/{id}/redeliver, POST /orders/{id}/resend-receipt, POST /orders/{id}/refund, PUT /orders/{id}/note, DELETE /orders/{id}/note — scope orders:read / orders:write
- Subscriptions: GET /subscriptions, GET /subscriptions/{id}, POST /subscriptions/{id}/cancel, POST /subscriptions/{id}/extend — scope subscriptions:read / subscriptions:write
- Customers: GET /customers, GET /customers/{id}, POST /customers/{id}/balance, POST /customers/{id}/ban, DELETE /customers/{id}/ban — scope customers:read / customers:write
- Reviews: GET /reviews, GET /reviews/{id}, PATCH /reviews/{id}, PUT /reviews/{id}/reply, DELETE /reviews/{id}/reply — scope reviews:read / reviews:write
- Tickets: GET /tickets, GET /tickets/{id}, POST /tickets/{id}/messages, PATCH /tickets/{id}, POST /tickets/{id}/close — scope tickets:read / tickets:write
- Store: GET /store, PATCH /store — scope store:read / store:write
- Webhooks: GET /webhooks, POST /webhooks, GET /webhooks/{id}, PATCH /webhooks/{id}, DELETE /webhooks/{id}, POST /webhooks/{id}/rotate-secret, POST /webhooks/{id}/test, GET /webhooks/{id}/deliveries — scope webhooks:read / webhooks:write
- Analytics: GET /analytics — scope analytics:read
- Your key: GET /me — any key

## Webhooks

- Every delivery is a signed POST: X-Hidden-Event, X-Hidden-Delivery, X-Hidden-Timestamp, X-Hidden-Signature (sha256=HMAC-SHA256 of `${timestamp}.${rawBody}` with the endpoint secret). Verify before you trust the payload.

Docs index: https://docs.sellhidden.com/llms.txt
```