Pay a Claude CMS store through an AI agent

Every store built on Claude CMS can be bought from through an AI assistant acting for a human: hand the person a buy link to the store’s own checkout — any assistant can compose one — or, if you can call an API, a hosted Stripe payment page. Either way the money settles in the merchant’s own Stripe account and shows up as an ordinary order. No API keys for the agent, no card details anywhere near it.

OpenAPI llms.txt Manifest API root

Start here: the playbook

Order of preference: buy link → lookup → API → product page. The order reflects what works for the most assistants, not what is most powerful.

Identify the product. Its page is https://<store>/product/<handle>; the handle is the last part of that address. Or open the store’s own /llms.txt, which lists every product with a ready-made buy link.
First choice — the buy link. Simplest: add ?buy=1 to the product page URL you already have — https://<store>/product/<handle>?buy=1 — and it opens the store’s own checkout with that item. The long form is https://<store>/checkout?buy=<handle>&qty=1. Add &variant=<id> when the product comes in several variants and &qty=<n> for more than one. It works on every up-to-date Claude CMS storefront (the lookup below confirms it for a given store), needs no call and no key, and nothing is created until they pay. Product pages also carry it as schema.org BuyAction and as the Buy now button.
Verify it, and get the price. GET https://claudecms.com/api/agent/checkout?store=<store>&handle=<handle>&qty=1 answers data.ready: true with the same link in data.buy_link and the item total in data.amount_pence. If ready is false, data.blockers says why (for example a variant must be named). Opened in a browser, that URL goes straight to the checkout, so it is itself a link you can hand over.
If you can POST and the human needs a hosted Stripe page — for a plain amount, an order attributed to you, or payment status you can poll — use the API below: "preview": true first, then create.
If everything else fails, send the product page and tell the human to press Buy now. Never invent a checkout URL: the forms above are the only ones that exist.

How the API path works

The agent names the store and what to pay for. By the merchant’s domain (example.com) or store handle, with a list of products (SKU, product handle or variant id) or a plain amount and a description.

claudecms.com checks and creates a Stripe Checkout page on the merchant’s connected Stripe account, using the store’s live prices, stock, shipping rates and tax. The page is single-use and lasts 24 hours.

The human pays on Stripe’s hosted page. They see the merchant’s name and the exact amount before entering anything.

The agent polls the status and sees paid with the order number. The merchant has a normal order in their Claude CMS shop, with a note saying which agent created it.

For AI agents

Two ways to get a human to a payment page. If you can only read the web, compose a buy link and hand it over. If you can make HTTP calls, the API creates a hosted Stripe page, attributes the order to you and lets you poll until it is paid.

1. The buy link — any assistant, no call

Most assistants can read pages but cannot make an HTTP POST. Every Claude CMS storefront therefore accepts a link you can compose from a product page, with no call and no key:

https://<store domain>/checkout?buy=<product handle>&qty=1

The handle is the last part of the product page’s address. Add &variant=<id> when the product comes in several variants, or leave it off and the shopper is taken to the product page to choose. The link opens the store’s own checkout with that item in the bag; nothing is created or charged until the human pays, so it is safe to put in a message.

Worked example: the demo store’s Product 3 becomes https://claudecms.com/store-demo/checkout?buy=product-3&qty=1. Product pages also publish the link as a schema.org BuyAction and show it as a “Buy now” button, and every storefront publishes its own /llms.txt — the three ways to buy there, with a ready-made buy link for each product (for example the demo store’s). Start there.

Want it checked first, or only know the SKU? Ask the same endpoint with a GET — it validates the store and the product with a preview, creates nothing, and answers with the link to hand over:

GET https://claudecms.com/api/agent/checkout?store=<store domain>&handle=<product handle>&qty=1
GET https://claudecms.com/api/agent/checkout?store=<store domain>&sku=<sku>&qty=1

The reply’s data.buy_link is the URL to give the human, data.ready says whether the store can take the order, and data.amount_pence is the item total before delivery. Try it: store=claudecms.com/store-demo&sku=P3.

2. The API — agents that can POST

One endpoint, no authentication. Quote first with "preview": true; it validates the store and the items and tells you whether the store is ready without creating anything.

POST https://claudecms.com/api/agent/checkout
Content-Type: application/json

{
  "store": "example.com",
  "items": [{ "sku": "SKU-12345", "quantity": 1 }],
  "buyer_email": "sam@example.com",
  "shipping_country": "US",
  "agent": "MyAssistant/2.1",
  "preview": true
}

Or a plain amount, for a service, a deposit or an invoice:

{
  "store": "example-store",
  "amount_pence": 4500,
  "description": "Consultation, 12 October",
  "buyer_email": "sam@example.com",
  "reference": "consult-2026-10-12-sam"
}

Without preview the answer is 201 with the page to hand over:

{
  "data": {
    "id": 42,
    "status": "open",
    "checkout_url": "https://checkout.stripe.com/c/pay/cs_live_…",
    "status_url": "https://claudecms.com/api/agent/checkout?id=42&t=…",
    "expires_at": "2026-10-04T14:05:00Z",
    "amount_pence": 4500,
    "currency": "USD",
    "merchant": { "name": "Example Store", "handle": "example-store" }
  }
}

Poll status_url (GET) until data.status is paid; the response then carries order_number. Other states: open, expired, cancelled, failed.

Fields

Field	Meaning
`store`	Required. The merchant’s website domain or Claude CMS store handle.
`items`	Products to buy: `sku`, or `handle` (+ `variant` when the product has several), or `variant_id`, each with `quantity`. Shipping and any tax are added on the payment page from the store’s own rates.
`amount_pence` + `description`	Instead of items: the total to pay in the store currency’s minor unit (`2500` = 25.00) and what it is for.
`buyer_email`	Optional; prefilled on the payment page.
`reference`	Optional; your own id. Repeating it while the earlier link is open returns that link instead of making a second one.
`shipping_country`	Optional ISO 2 code for item purchases; defaults to where the store ships.
`success_url` / `cancel_url`	Optional https pages to return the buyer to; otherwise claudecms.com shows a confirmation.
`agent`	Your name and version. The merchant sees it on the order.

When it says no

Code	What to tell the human
`store_not_found`	The site is not built on Claude CMS, so it cannot be paid this way.
`agent_payments_off`	The store has not switched on payments by agents. Buy on their website instead.
`stripe_not_ready` / `stripe_not_connected`	The store cannot take payments yet.
`variant_required`	Pick one of the listed variants (the response names them with prices).
`out_of_stock`, `product_unavailable`, `no_shipping_rates`	Exactly that; the store’s own rules.
`amount_too_large`	Over the store’s per-link maximum (the message says the limit).
`rate_limited` / `store_busy`	Try again after the `Retry-After` period.

For store owners

Switch it onClaude CMS → Shop → the Agents toggle at the top. It starts off. Set the most one link may be for under Orders → Agent payments.

Nothing new to runPayments arrive as normal orders, in your Stripe account, with a note naming the agent and the reference. Refunds, shipping and emails work exactly as they do today.

Your own Claude can do it tooAsk it: “Create a payment link for £300 for Sarah’s logo work and give me the link”. It uses the store_payment_link tool and the link appears in Orders → Agent payments.

Only stores on Claude CMS with a connected Stripe account that can take charges are reachable. If an agent asks for your store before you have switched it on, it is told so and nothing is created.

Safety

Money goes one way: to the merchant’s own Stripe account. There is no way to send funds anywhere else, so impersonating a store buys an attacker nothing.
No card data here: the buyer enters details on Stripe’s page; neither the agent nor claudecms.com sees them. Stripe Radar screens the payment as it does every sale.
The human always confirms: the merchant’s name and the amount are on the page before anything is entered.
Limits: a per-link maximum set by each store (default 500.00), 20 links an hour per address, 60 an hour per store, 10 an hour per buyer; links are single-use and expire after 24 hours.
What is kept: the agent’s name, address, the items or amount, the buyer email the agent gave, and the outcome — shown to the merchant under Agent payments.

Questions or a store that should be reachable but is not: get in touch.