inventpay-fc70da — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited inventpay-fc70da (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Accept crypto payments, run a digital storefront, and track balances through the InventPay REST API.
This skill teaches your agent how to interact with the InventPay payment platform using direct HTTP requests. No external packages or binaries required — your agent makes standard REST API calls.
Your agent can:
openclaw install inventpayNo binaries or packages needed. This skill is instruction-only.
pk_live_)export INVENTPAY_API_KEY="pk_live_your_key_here"Ask your agent: "What's my InventPay balance?"
The agent should make a GET request to https://api.inventpay.io/v1/merchant/balance with your API key and return your balances. If you see an auth error, check that INVENTPAY_API_KEY is set and starts with pk_live_.
https://api.inventpay.ioAll authenticated endpoints require:
Header: X-API-Key: <INVENTPAY_API_KEY>
Content-Type: application/jsonThe API key (pk_live_...) is your main merchant key for all operations: payments, invoices, store, products, orders, and balances.
POST /v1/create_payment — NOT /v1/paymentsPOST /v1/create_invoice — NOT /v1/invoices or /v1/store/manage/invoicesGET /v1/merchant/balance — NOT /v1/balancePOST /v1/store/{slug}/checkout — uses the store URL slug (e.g. "my-store"), NOT a store IDhttps://inventpay.io/store/{slug}https://inventpay.io/store/{slug}/product/{productSlug} — the /product/ segment is requiredhttps://inventpay.io/invoice/{paymentId}/product/ from product URLs — /store/{slug}/{productSlug} will NOT workAll responses follow the format: { "success": true/false, "data": {...}, "message": "..." }
#### Create a fixed-currency payment
Use when you know which cryptocurrency the buyer will pay with.
POST /v1/create_payment
Header: X-API-Key: <INVENTPAY_API_KEY>
Content-Type: application/json
{
"amount": 50.00, // required — payment amount
"currency": "USDT_BEP20", // required — BTC, ETH, LTC, USDT_ERC20, USDT_BEP20, SOL, USDC_SOL, USDC_BEP20
"amountCurrency": "USD", // optional, default "USDT" — USD, USDT, BTC, ETH, LTC, SOL
"orderId": "order-123", // optional — your reference ID (max 100 chars)
"description": "Payment for service", // optional (max 500 chars)
"callbackUrl": "https://your-site.com/webhook", // optional — webhook for status updates
"expirationMinutes": 30 // optional, default 30, range 5-1440
}Response includes: paymentId, amount (crypto amount), currency, address (wallet to pay), invoiceUrl (shareable link), qrCode, expiresAt.
Use /v1/create_payment for single-crypto payments. Use /v1/create_invoice for multi-crypto choice.
#### Create a multi-currency invoice
Use when you want the buyer to choose which crypto to pay with.
POST /v1/create_invoice
Header: X-API-Key: <INVENTPAY_API_KEY>
Content-Type: application/json
{
"amount": 100.00, // required
"amountCurrency": "USD", // optional, default "USDT"
"orderId": "inv-456", // optional
"description": "Monthly subscription", // optional
"callbackUrl": "https://your-site.com/webhook", // optional
"expirationMinutes": 60 // optional, default 60
}Response includes: paymentId, invoiceUrl (send this to the buyer), expiresAt, availableCurrencies.
#### Check payment status
GET /v1/invoice/{paymentId}/status
No authentication required (public endpoint)Response: { "status": "PENDING", "currentBalance": 0, "confirmations": 0 }
Statuses: PENDING, PROCESSING, COMPLETED, EXPIRED, CANCELLED, FAILED, UNDERPAID.
#### Get all balances
GET /v1/merchant/balance
Header: X-API-Key: <INVENTPAY_API_KEY>Response:
{
"success": true,
"data": {
"merchantId": "...",
"businessName": "...",
"balances": {
"balances": [
{
"currency": "USDT_BEP20",
"totalEarned": 812.71,
"totalWithdrawn": 25.30,
"totalFees": 1.41,
"availableBalance": 504.87,
"lockedBalance": 265.10,
"pendingBalance": 0
}
],
"summary": {
"totalAvailable": 504.92,
"totalLocked": 265.10,
"totalPending": 0,
"totalEarned": 812.77,
"totalWithdrawn": 25.30,
"totalFees": 1.41
}
}
}
}#### Get balance for a specific currency
GET /v1/merchant/balance/{currency}
Header: X-API-Key: <INVENTPAY_API_KEY>Currency must be: BTC, ETH, LTC, USDT_ERC20, USDT_BEP20, SOL, USDC_SOL, or USDC_BEP20.
#### Create a store
POST /v1/store/manage
Header: X-API-Key: <INVENTPAY_API_KEY>
Content-Type: application/json
{
"name": "My Digital Store", // required, 2-100 chars
"description": "Selling digital goods" // optional, max 1000 chars
}Response includes: id, name, slug, url (public store page at inventpay.io/store/{slug}), isActive, product/order counts.
#### Get your store
GET /v1/store/manage
Header: X-API-Key: <INVENTPAY_API_KEY>#### Update your store
PUT /v1/store/manage
Header: X-API-Key: <INVENTPAY_API_KEY>
Content-Type: application/json
{
"name": "Updated Name", // optional
"description": "New desc", // optional
"logo": "https://...", // optional, HTTPS URL
"banner": "https://...", // optional, HTTPS URL
"isPublished": true // optional
}#### Create a product
POST /v1/store/manage/products
Header: X-API-Key: <INVENTPAY_API_KEY>
Content-Type: application/json
{
"name": "Premium Skill Bundle", // required, 1-200 chars
"price": 9.99, // required, 0.01-1000000 (in USDT)
"description": "10 advanced skills", // optional, max 5000 chars
"images": ["https://example.com/img.jpg"], // optional, max 10 URLs
"stock": 100, // optional, omit for unlimited
"contentType": "GENERAL", // optional — "GENERAL" (default) or "SKILL"
"skillContent": "---\nname: ...\n---\n...", // optional — raw SKILL.md content, only when contentType is "SKILL"
"digitalContent": { // optional — for automatic delivery on payment
"fileUrl": "https://example.com/bundle.zip", // download link
"fileName": "skill-bundle-v2.zip", // display name
"instructions": "Extract and copy to your skills folder",
"licenseKey": "SKILL-PRO-2026", // access code
"textContent": "Inline content here" // or deliver text directly
}
}Response includes: id, name, slug, price, isActive, productUrl, contentType, skillMeta.
Digital products auto-deliver after payment via the digitalContent field.
When contentType is "SKILL", the backend automatically parses YAML frontmatter from skillContent and stores it as skillMeta (name, version, author, tags, etc.) for storefront display. The raw skillContent is never exposed publicly — it is delivered to the buyer after payment.
#### List products
GET /v1/store/manage/products?page=1&limit=20&search=skill
Header: X-API-Key: <INVENTPAY_API_KEY>Query parameters: page (default 1), limit (default 20, max 50), search (by name).
#### Update a product
PUT /v1/store/manage/products/{productId}
Header: X-API-Key: <INVENTPAY_API_KEY>
Content-Type: application/json
{
"name": "Updated Name", // optional
"price": 14.99, // optional
"description": "...", // optional
"stock": 50, // optional
"isActive": true, // optional
"contentType": "SKILL", // optional — "GENERAL" or "SKILL"
"skillContent": "---\n...", // optional — raw SKILL.md, only for SKILL type
"digitalContent": { ... } // optional
}#### Delete a product
DELETE /v1/store/manage/products/{productId}
Header: X-API-Key: <INVENTPAY_API_KEY>If the product has order history it gets deactivated (soft delete). If no orders exist it gets permanently removed.
For products where each buyer gets a unique license key, activation code, or content.
#### Upload keys
POST /v1/store/manage/products/{productId}/keys
Header: X-API-Key: <INVENTPAY_API_KEY>
Content-Type: application/json
{
"keys": ["KEY-001", "KEY-002", "KEY-003"], // required, 1-10000 unique keys
"label": "Batch #1" // optional, max 200 chars
}Response: { "added": 3, "duplicates": 0 }
#### List keys
GET /v1/store/manage/products/{productId}/keys?page=1&limit=50&status=AVAILABLE
Header: X-API-Key: <INVENTPAY_API_KEY>Query: page, limit (max 100), status (AVAILABLE, ASSIGNED, REVOKED).
#### Get key pool stats
GET /v1/store/manage/products/{productId}/keys/stats
Header: X-API-Key: <INVENTPAY_API_KEY>Returns: total, available, assigned, revoked, useKeyPool.
#### Remove all available keys
DELETE /v1/store/manage/products/{productId}/keys
Header: X-API-Key: <INVENTPAY_API_KEY>Only removes unassigned (AVAILABLE) keys. Assigned keys are preserved.
#### List orders
GET /v1/store/manage/orders?page=1&limit=20&status=PAID
Header: X-API-Key: <INVENTPAY_API_KEY>Query: page, limit (max 50), status (PENDING, PAID, PROCESSING, SHIPPED, COMPLETED, CANCELLED, REFUNDED).
#### Get order details
GET /v1/store/manage/orders/{orderId}
Header: X-API-Key: <INVENTPAY_API_KEY>Returns full order with items, payment info, customer details, and delivery status.
#### Update order status
PUT /v1/store/manage/orders/{orderId}/status
Header: X-API-Key: <INVENTPAY_API_KEY>
Content-Type: application/json
{
"status": "COMPLETED", // PROCESSING, SHIPPED, COMPLETED, CANCELLED, REFUNDED
"notes": "Delivered successfully" // optional, max 500 chars
}Valid transitions: PAID can go to PROCESSING/SHIPPED/COMPLETED/CANCELLED/REFUNDED. Digital products auto-complete on payment.
POST /v1/store/{slug}/checkout
Content-Type: application/json
{
"items": [{ "productId": "prod_...", "quantity": 1, "variant": {} }],
"customerEmail": "[email protected]",
"customerName": "John Doe",
"currency": "USDT_BEP20" // optional
}Uses the store URL slug (e.g. "my-store"), NOT a store ID.
GET /v1/store/manage/analytics
Header: X-API-Key: <INVENTPAY_API_KEY>Returns: order counts by status, total/confirmed revenue in USDT, product count, store info.
When the user asks to create or add a new product, ALWAYS ask them:
contentType: "SKILL" and put the raw markdown in skillContent. The backend will auto-parse the YAML frontmatter.contentType: "GENERAL" or omit it.Do NOT skip the content type question. This is important because SKILL products get special storefront display (skill badge, version, author, tags) and the raw .md file is delivered to the buyer after payment.
Creating a payment:
"Create a $25 USDT payment for the logo design"
Agent makes: POST /v1/create_payment with {"amount": 25, "currency": "USDT_BEP20", "description": "Logo design"} and returns the payment link.
Setting up a store:
"Create a store called AI Skill Shop"
Agent makes: POST /v1/store/manage with {"name": "AI Skill Shop"} and returns the store URL.
Adding a product:
"Add a product called Code Review Skill for $8 with download URL https://files.example.com/review-skill.md"
Agent makes: POST /v1/store/manage/products with name, price, and digitalContent.fileUrl.
Adding a skill product:
"Create a skill product called 'SEO Audit Skill' for $5 with this SKILL.md content: ---\nname: seo-audit\nauthor: devtools\nversion: 1.0.0\ntags: [seo, audit]\n---\n\n# SEO Audit\n..."
Agent makes: POST /v1/store/manage/products with name, price, contentType: "SKILL", and skillContent containing the raw markdown.
Checking balance:
"What's my balance?"
Agent makes: GET /v1/merchant/balance and summarizes available amounts per currency.
Checking orders:
"Show me recent paid orders"
Agent makes: GET /v1/store/manage/orders?status=PAID and lists them.
Managing key pool:
"Upload 50 license keys for the Pro Skill product"
Agent makes: POST /v1/store/manage/products/{id}/keys with the keys array.
Practical setup for monetizing premium skill files:
POST /v1/store/managecontentType: "SKILL", paste the raw SKILL.md into skillContent, set a price. The backend parses frontmatter automatically for the storefront. Alternatively, use contentType: "GENERAL" with a digitalContent.fileUrl for a hosted download link.inventpay.io/store/your-slugGET /v1/merchant/balanceWhat sells well: industry-specific skills, complex automation chains, curated skill bundles, premium versions of popular free skills, API integration skills. Price range $3-15 for individual skills, $20-40 for bundles.
pk_live_...) is used for all operationsdigitalContent field/product/ segment: /store/{slug}/product/{productSlug}INVENTPAY_API_KEY can create payments, manage your store, and read balances. It cannot withdraw or transfer funds.| Variable | Required | Description |
|---|---|---|
INVENTPAY_API_KEY | Yes | Merchant API key (pk_live_...). Used for payments, store, products, orders, balances. Cannot withdraw funds. |
InventPay — Crypto payment infrastructure for developers and AI agents.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.