Windsurf + Pocketsflow

{
  "mcpServers": {
    "pocketsflow": {
      "serverUrl": "https://api.pocketsflow.com/mcp",
      "headers": {
        "Authorization": "Bearer pk_test_xxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

# Pocketsflow integration rules

## Project
Server-side integration with the Pocketsflow API: create checkout sessions,
redirect buyers, and settle orders from signed webhooks.

## Facts
- Base URL: https://api.pocketsflow.com
- Auth: `Authorization: Bearer <API key>` (`pk_live_…` / `pk_test_…`).
- Keep API keys and webhook signing secrets in env vars, never client-side.

## Checkout
- `POST /checkout/sessions` returns `{ id, url }`; redirect the buyer to `url`.
- Put our own order id in `metadata`; it is echoed back on the order and related
  webhooks for reconciliation.

## Webhooks
- Verify the `X-Pocketsflow-Signature` HMAC-SHA256 over the RAW body.
- Confirm payment from `order.completed`; make handlers idempotent.

## References
- Docs: Integrations → Custom platforms; API & Webhooks → Consuming webhooks.
- Interactive API reference: https://api.pocketsflow.com/docs