Windsurf + Pocketsflow - Pocketsflow Docs

Windsurf is an AI-native editor whose Cascade agent can call tools and edit code. Connect it to the Pocketsflow MCP server so Cascade can act on your account, and add a workspace rule so it writes integration code correctly.

Prerequisites

Windsurf installed.
A Pocketsflow account. No API key needed: you approve Windsurf with your Pocketsflow login.

Connect the Pocketsflow MCP server

Add the Pocketsflow MCP server to Windsurf’s MCP config (Cascade → MCP servers → Configure, which edits ~/.codeium/windsurf/mcp_config.json):

{
  "mcpServers": {
    "pocketsflow": {
      "serverUrl": "https://api.pocketsflow.com/mcp"
    }
  }
}

Refresh the server list in Cascade. When Windsurf connects, your browser opens Pocketsflow: sign in and click Allow access. Pocketsflow creates a dedicated MCP: … API key for the connection; delete it under Developers → API keys to disconnect. Connect while your account is in test mode to keep Cascade on sandbox data while you build. Cascade can now run Pocketsflow tools — “list my last 10 orders”, “create a $29 product and give me the checkout link”, “cancel subscription sub_123”. Each call runs as your account.

Alternative: API key (headless / CI)

To skip the sign-in, create a key under Developers → API keys and send it as a header:

{
  "mcpServers": {
    "pocketsflow": {
      "serverUrl": "https://api.pocketsflow.com/mcp",
      "headers": {
        "Authorization": "Bearer pk_test_xxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

With the header variant, the MCP config holds your API key — keep it out of shared repos. Prefer a pk_test_… key while developing, and never expose pk_live_… keys.

Add a workspace rule

Give Cascade project context and standards. Create .windsurf/rules/pocketsflow.md in your workspace root:

# Pocketsflow integration rules

## Project
Server-side integration with the Pocketsflow API: create checkout sessions,
redirect buyers, and settle orders from signed webhooks.

## Facts
- Base URL: https://api.pocketsflow.com
- Auth: `Authorization: Bearer <API key>` (`pk_live_…` / `pk_test_…`).
- Keep API keys and webhook signing secrets in env vars, never client-side.

## Checkout
- `POST /checkout/sessions` returns `{ id, url }`; redirect the buyer to `url`.
- Put our own order id in `metadata`; it is echoed back on the order and related
  webhooks for reconciliation.

## Webhooks
- Verify the `X-Pocketsflow-Signature` HMAC-SHA256 over the RAW body.
- Confirm payment from `order.completed`; make handlers idempotent.

## References
- Docs: Integrations → Custom platforms; API & Webhooks → Consuming webhooks.
- Interactive API reference: https://api.pocketsflow.com/docs

Use the Copy as Markdown / open-in-editor action in the top-right of any docs page to paste an authoritative reference straight into Cascade as context.

Typical workflow

Plan with Cascade

Ask Cascade to design the checkout + webhook flow using the workspace rule and docs.

Validate via MCP

Have it create a test product and checkout session in test mode.

Exercise the webhook

Send a test event and confirm the handler verifies the signature and settles the order idempotently.

​Connect the Pocketsflow MCP server

​Alternative: API key (headless / CI)

​Add a workspace rule

​Typical workflow

​Related topics

Connect the Pocketsflow MCP server

Alternative: API key (headless / CI)

Add a workspace rule

Typical workflow

Related topics