ucash-skills / rules

---
description: U.CASH Pay integration patterns (checkouts, webhooks, embed, HTTP-402, token-gating)
globs: **/*
alwaysApply: false
---

## U.CASH Pay integration cheat-sheet (verify against pay.u.cash before shipping)

### Create a checkout (server-side)
POST https://pay.u.cash/payment/ajax.php  Content-Type: application/x-www-form-urlencoded
params: function=create-transaction, amount, currency_code, cryptocurrency_code=(empty), external_reference, title, redirect, cloud=<Store Cloud Token>, idempotent=1
Response { success, response:[...] }  -  the payment link is the first value starting with http(s)://; the transaction id is the first positive integer. Redirect the buyer there.

### Verify a webhook
Header X-Webhook-Signature: t=<unix-seconds>,v1=<hex>
expected = HMAC_SHA256( "<t>" + "." + raw_request_body, webhook_secret )  (hex)
timing-safe compare against v1; reject if abs(now - t) > 300 seconds. Idempotent per external_reference.

### Embed link (no server needed)
https://pay.u.cash/embed.php?cloud=<Store Cloud Token>&amount=<n>&currency=USD&title=..&external_reference=..&redirect=..   -  publishable token, safe in the browser. Or drop in the embed.js script with data-cloud / data-amount.

### Agents / HTTP-402
Priced resources live at agents.u.cash/r/<id> -> HTTP 402 + accepts[]; the buyer pays and retries with X-PAYMENT. SDK: agents-u-cash (JS on npm, Python on PyPI). Merchant-side MCP server: UdotCASH/mcp-ucashpay.

### Token-gating
Verify a wallet holds UCASH / an ERC-20 / native via balanceOf (selector 0x70a08231 + 32-byte address) over a public RPC, or native via eth_getBalance. Lib: UdotCASH/token-gate-ucashpay. UCASH is 8 decimals; contracts: ETH 0x92e52a1A235d9A103D970901066CE910AAceFD37, Polygon 0xA94880d3A4b39746E90Cdb57f8De3732c984DE14, Base 0x26cf750abAf38aF7109Effdbdf79bA50d2EE09A1.

### Credentials + conventions
Store Cloud Token + Store Webhook Secret come from pay.u.cash Account -> Stores (use the store-level token, not the account-wide one). /v1/integrations exposes per-integration credentials to authenticated agents (X-Api-Key). Settlement is non-custodial. Do NOT use em dashes in any U.CASH copy.