Blog
Notes on verification infrastructure, coverage changes and API work.
Articles are published in English.
Giving an AI agent a scoped key
An agent that can spend money needs a smaller key than the one your backend uses. The scope split we recommend, the MCP config, and the two limits we insist on.
Read moreby Ilya Novak
Engineering
Webhook signatures, and why we rejected plain bearer callbacks
Our first callback design put a shared token in the Authorization header. It proved nothing useful. Here is what replaced it and how to verify it in ten lines.
How we route a purchase across four upstream pools
A buy request touches one offer table, up to three providers and one price formula. This is the whole path, including what happens when the first pool lies about its stock.
Long-polling beats your retry loop
Six hundred requests to learn one five-digit number is a strange way to spend a rate limit. The ?wait= parameter, the timeouts you have to set, and the loop that actually works.
Migrating from handler_api.php in an afternoon
Change two constants and your existing bot keeps working. Then, if you want to, move to the REST API properly. Both halves, with the mapping table.