stripeJun 11, 2026

Stripe Projects adds new agent integrations, more providers, and custom developer controls (opens in new tab)

Agent traffic now exceeds human internet traffic, driven largely by agents independently building software and integrating APIs. Stripe reports that agents account for nearly 40% of its documentation traffic and 70% of API-resource requests through the Stripe CLI. Stripe Projects is expanding to help agents handle the infrastructure, credentials, services, and operational controls surrounding software development. ## Agent Integrations - Stripe Projects is available as a skill in Hermes, an open-source AI agent from Nous Research. - Hermes can retain context across sessions, allowing it to collaborate on complex projects over days or weeks. - Factory Droids and Warp have integrated the Projects CLI into their coding workflows. ## Expanded Provider Support - Projects now supports 49 providers, adding 16 new integrations. - New providers include: - Metronome for usage-based billing - Wix for storefronts - ClickHouse for LLM observability - Agents can provision applications, billing, storefront, monitoring, and other services without manually navigating provider dashboards. ## Controls for Safe Agent Provisioning Stripe is adding guardrails similar to those used for agent-driven purchases: - **Unified cost visibility:** Developers can view current and historical spending across providers for each project. - **Per-provider spending limits:** Teams can set different caps for services such as AI models, hosting, and databases. - **Named environments:** Isolated credentials can be created for development, staging, production, or custom environments. Agents default to development, reducing the risk of affecting production. - **Platform delegation:** Platforms can provision services for users using scoped credentials and white-labeling, keeping developers inside the platform’s environment. ## Future Direction Stripe plans to extend Projects across the full lifecycle of agent-built software, including operations and security. Planned additions include stronger security primitives for autonomous agents and a data layer that lets providers meter and bill for software created by agents. Stripe’s broader recommendation is to use Projects as an agent-accessible way to provision infrastructure—for example, asking an agent to add a Prisma database.

api-integrationai-agentclickhousehermes+4

tossApr 27, 2026

Why We Adopted Post-Quantum Cryptography a Decade Before Quantum Computers Arrive (opens in new tab)

Toss Payments’ biggest legacy-overhaul challenge was not the technology itself, but improving security without disrupting tens of thousands of merchants using decades-old integrations. Because payment systems depend on outdated client environments and small businesses with limited technical resources, security upgrades had to be gradual and carefully communicated. The effort ultimately led from modernizing transport security to adopting post-quantum cryptography in 2026. ## The Challenge of Changing a Legacy Payment Network - Toss Payments supports merchants integrated with its PG system for many years, sometimes decades. - Server-side clients are harder to update than browsers, which update automatically to support new standards. - Security changes such as upgrading TLS, removing weak ciphers, or changing encryption can affect every API call, payment window, and server connection. - Many merchants are small businesses without dedicated developers, making complex security requirements difficult to understand and implement. - As a result, security is a shared responsibility: Toss Payments can strengthen its systems, but legacy merchant environments may still leave connections partially exposed. ## Why Existing Encryption Is Becoming Unsafe - Modern HTTPS and payment systems commonly rely on public-key algorithms such as RSA and ECDSA. - These algorithms are considered secure because conventional computers cannot practically factor enormous numbers or solve elliptic-curve problems. - Quantum algorithms have been mathematically shown to solve these problems efficiently once sufficiently powerful quantum computers exist. - This would make current encryption systems vulnerable, undermining decades of digital-security assumptions. ## Q-Day and “Harvest Now, Decrypt Later” - “Q-Day” refers to the point when quantum computers can break today’s widely used encryption. - Attackers can already intercept and store encrypted payment communications that they cannot currently decrypt. - Once quantum computers become practical, the stored data could be decrypted in bulk. - Payment information is especially valuable because it can remain sensitive for years; data transmitted today could be exposed in the 2030s. - The threat therefore requires action before quantum computers are fully operational. ## A Four-Year Security Upgrade Toss Payments chose a phased approach rather than replacing its security stack all at once: - **2022:** Became the first payment gateway in Korea’s PG industry to implement HTTP/3. - **2022–2025:** Removed weak TLS cipher suites. - **2022–2025:** Completed the rollout of TLS 1.3. - **April 2026:** Implemented post-quantum cryptography (PQC). Each stage balanced stronger protection against the risk of disrupting merchant payments. The gradual rollout gave merchants time to update their systems while ensuring that security improvements continued instead of being postponed indefinitely. ## Starting with HTTP/3 - HTTP/3 is a newer web-transport protocol designed to improve speed and stability, especially on unreliable networks. - It requires TLS 1.3, meaning that adopting HTTP/3 also enforces the use of a modern security protocol. - Toss Payments began with HTTP/3 because it offered both performance improvements and a relatively direct path toward stronger encryption. The broader lesson is that legacy security cannot be improved through a single disruptive upgrade. A phased migration, combined with clear communication and preparation for post-quantum cryptography, allows payment providers to raise security standards while keeping existing merchants operational.

api-integrationdatabase-designpost-quantum-cryptographyquantum-computing+4

tossApr 23, 2026

Applying Post-Quantum Cryptography for the Quantum Computing Era: Why Implement It 10 Years Early? (opens in new tab)

Toss Payments’ hardest legacy-modernization challenge was not replacing old systems, but improving security across tens of thousands of merchants with diverse, outdated environments. Over four years, it gradually introduced HTTP/3, removed vulnerable cipher suites, deployed TLS 1.3, and ultimately adopted post-quantum cryptography (PQC) in April 2026. The central lesson is that security upgrades must begin early and be introduced gradually, with merchant support and backward compatibility built in. ## Breaking the Inertia of Legacy Systems - Mission-critical payment services tend to follow the principle: “If it works, don’t touch it.” - Security protocol changes are particularly difficult because they can affect every merchant integration and may be hard to troubleshoot or roll back. - Many merchants still operate decades-old server-side systems that cannot support modern security policies. - Documentation alone is often insufficient, especially for merchants without dedicated development teams. - Because every API, SDK, payment window, and server connection is part of the security boundary, Toss Payments could not improve security independently of its merchants. ## Why Existing Encryption Must Evolve - Modern HTTPS, banking, and payment systems rely heavily on RSA and ECDSA. - These algorithms are considered secure because factoring large numbers and solving elliptic-curve problems is impractical for classical computers. - Quantum computers could solve these problems efficiently, making current public-key cryptography vulnerable. - The anticipated point at which quantum computers can break these systems is often called “Q-Day.” - The “Harvest Now, Decrypt Later” threat means attackers can collect encrypted payment data today and decrypt it years later when quantum computers become practical. ## A Four-Year Security Upgrade Program Toss Payments chose a gradual migration strategy to improve security without abruptly disrupting merchant payments: - **2022:** Introduced HTTP/3, which requires TLS 1.3. - **2022–2025:** Removed vulnerable TLS cipher suites. - **2022–2025:** Enabled TLS 1.3 across all endpoints. - **April 2026:** Introduced post-quantum cryptography. ## HTTP/3 as a Low-Impact Starting Point - HTTP/3 improves speed and reliability on unstable networks. - Because it requires TLS 1.3, enabling HTTP/3 also raised security standards. - Modern browsers automatically select HTTP/3, so merchants required no configuration changes. - This made HTTP/3 an effective first step with minimal migration risk. ## Gradual Cipher Suite Removal - A cipher suite defines the algorithms used by a client and server to establish encrypted communication. - Some legacy merchant servers supported only vulnerable suites, such as `TLS_RSA_WITH_AES_128_CBC_SHA`. - Removing them immediately could stop payments for affected merchants, while delaying removal would leave the wider ecosystem exposed. - Toss Payments used: - Merchant-by-merchant compatibility analysis - Individual notifications six months to a year in advance - Environment-specific documentation and configuration guidance - Technical consulting where necessary - The Technical Account Manager team was essential in coordinating these changes and communicating with merchants in accessible language. ## TLS 1.3 Deployment - TLS 1.2 remained the minimum supported version, while TLS 1.3 was added alongside it. - Clients capable of TLS 1.3 automatically use the stronger protocol. - Older clients continue using TLS 1.2 without forced changes. - TLS 1.3 was enabled endpoint by endpoint from 2022 and supported across all endpoints by 2025. - The process demonstrated that ecosystem-wide security improvements require more time helping merchants migrate than technically changing the servers. ## Post-Quantum Cryptography - Toss Payments began preparing for PQC in 2025 and completed deployment in April 2026. - Modern browsers and clients that support PQC automatically use stronger quantum-resistant channels. - Unsupported environments continue using established encryption methods, preserving compatibility. - Merchants do not need to change configurations or update their integrations. - The approach provides stronger protection against future quantum attacks while minimizing present-day disruption. ## Cross-Team Collaboration - **Infra Team:** Applied PQC within Toss Payments’ private data-center infrastructure and physical hardware. - **Server Platform Team:** Integrated PQC into live traffic paths in AWS. - **TAM Team:** Used its experience from the cipher-suite migration to guide merchants and assess integration environments. - The result was a large-scale, proactive security deployment across the private payment ecosystem. Toss Payments’ experience suggests that organizations should start security migrations well before threats become immediate. Compatibility layers, staged enforcement, and sustained technical support allow legacy ecosystems to adopt stronger security without sacrificing availability.

api-integrationdatabase-designpost-quantum-cryptographyhttp-3+3

cloudflareApr 16, 2026

Cloudflare’s AI Platform: an inference layer designed for agents (opens in new tab)

Cloudflare is positioning AI Gateway as a unified inference layer for agentic applications. It provides one API for models from multiple providers, centralized cost and reliability controls, and low-latency access through Cloudflare’s global network. The platform is also expanding toward customer-hosted models and multimodal inference, reducing dependence on any single AI vendor. ### A Unified Model Catalog and Endpoint - Developers can call Cloudflare-hosted and third-party models through the same `env.AI.run()` interface. - Switching models, such as from Workers AI to Anthropic or OpenAI, requires only a one-line change. - Cloudflare plans to add REST API support for applications that do not run on Workers. - The catalog includes more than 70 models from over 12 providers, spanning: - Text and reasoning models - Image, video, and speech models - Open-source models hosted on Workers AI - Proprietary models from major providers - Users pay through one credit system rather than managing separate provider accounts. ### Centralized Cost and Usage Management - AI Gateway gives companies a consolidated view of spending across providers. - Request metadata can categorize costs by: - Team - User - Customer - Workflow - Free versus paid usage - This is particularly useful for agents, which may make many model calls for a single user request. ### Bringing Custom Models to Workers AI - Cloudflare is working on allowing customers to deploy fine-tuned or specialized models through Workers AI. - The deployment workflow uses Replicate’s Cog technology to package models and manage: - Python dependencies - CUDA requirements - Model weights - Runtime configuration - Developers define the environment in `cog.yaml` and implement model setup and inference in `predict.py`. - After building the Cog container, Cloudflare can deploy and serve it through existing Workers AI APIs. - Planned improvements include customer-facing APIs, Wrangler commands, and GPU snapshotting to reduce cold-start times. ### Optimizing Agent Responsiveness - For live agents, time to first token can matter more than total inference time. - A small reduction in startup latency can make an agent feel significantly more responsive, even if the full answer still takes several seconds. - Cloudflare’s presence in 330 cities places gateways close to users and inference endpoints, reducing network delay before streaming begins. - Workers AI is adding agent-focused open-source models, including Kimi K2.5 and real-time voice models. Cloudflare’s direction is to make model selection, deployment, monitoring, and failover easier through a single infrastructure layer. For teams building agents, the platform offers a way to mix providers and custom models while controlling cost, latency, and operational complexity.

api-integrationcloudflarepythonai-gateway+4

cloudflareApr 15, 2026

Introducing Agent Lee - a new interface to the Cloudflare stack (opens in new tab)

Agent Lee is Cloudflare’s new in-dashboard AI assistant, designed to replace complex navigation with natural-language interaction across the Cloudflare platform. It can inspect account data, troubleshoot issues, and—when explicitly approved—make changes or deploy resources. Built on Cloudflare’s own infrastructure, it combines sandboxed code execution, permission controls, and generative UI to provide an interactive way to manage real accounts. ## A Natural-Language Interface to Cloudflare - Agent Lee understands account resources such as Workers, zones, DNS settings, and error rates. - Users can ask it to: - Identify the top error messages for a Worker. - Diagnose access problems involving a `www` prefix. - Enable Cloudflare Access for a domain. - Create an R2 bucket and connect it to a Worker. - It can retrieve account-specific context, use the appropriate tools, and present results through charts and other visualizations. - The beta reportedly serves about 18,000 daily users and performs nearly 250,000 tool calls per day across services including DNS, Workers, SSL/TLS, R2, Registrar, Cache, Cloudflare Tunnel, and API Shield. ## Codemode and Sandboxed Execution - Instead of exposing raw MCP tool definitions to the model, Agent Lee uses Codemode. - The model writes TypeScript that calls a generated API, which is intended to improve accuracy and support multi-step operations in a single script. - Generated code runs through a Cloudflare MCP server and a Durable Object acting as a credentialed proxy. - The Durable Object: - Classifies operations as reads or writes by inspecting the method and request body. - Proxies read operations directly. - Blocks write operations until the user explicitly approves them. - Keeps API keys out of generated code and injects credentials server-side. ## MCP Permissions and User Approval - Agent Lee connects to Cloudflare’s MCP server through: - A search tool for querying API endpoints. - An execute tool for running code that performs API requests. - Any operation that changes the account must pass through an elicitation step. - Approval is an enforced permission boundary rather than merely a confirmation-oriented interface feature. - Agent Lee cannot bypass the approval gate before executing writes. ## Built on Cloudflare’s Public Stack - Agent Lee uses the same building blocks available to Cloudflare customers: - Agents SDK - Workers AI - Durable Objects - Cloudflare’s MCP infrastructure - Cloudflare developed and tested the system in production against real accounts. - The company positions this approach as a way to identify platform limitations and validate patterns that other developers can reuse. ## Generative UI - Agent Lee supplements text responses with dynamically generated interface components. - Questions about traffic can produce interactive line charts rather than plain numerical summaries. - An adaptive grid lets users reserve space for new UI blocks by dragging across the interface and describing what they want. - Supported components include: - Tables - Interactive charts - Architecture maps - Other dynamic visual blocks - The result is intended to turn conversation history into an evolving operational dashboard. ## Quality and Safety - Elicitations are used whenever Agent Lee needs to perform a non-read action, requiring explicit approval in the interface. - Cloudflare also evaluates the system’s: - Conversation success rate - Information accuracy - Because the product remains in beta, users may encounter limitations or edge cases as its reliability and performance continue to improve. Agent Lee’s central promise is to make Cloudflare operations conversational without removing control. Its most important design choice is the combination of broad account awareness with a structural approval gate for changes, while its generative UI makes the resulting information and workflows more actionable.

api-integrationdatabase-designcloudflareui-design+4

gitlabMar 26, 2026

Getting started with GitLab feature flags in Python (opens in new tab)

GitLab feature flags let teams deploy code without immediately exposing it to users, reducing the risk of production failures and eliminating redeployments for rollbacks. Using the Unleash Python SDK, a Flask application can retrieve flag definitions from GitLab, cache them locally, and evaluate them quickly without a network request on every check. The tutorial demonstrates a practical setup using configurable rollout strategies such as user targeting, percentage rollouts, and all-user releases. ## Requirements and Project Setup - A GitLab project with Feature Flags enabled under **Settings > General > Visibility, project features, permissions**. - A fork or clone of the demo repository: - `app.py` contains the Flask and Unleash integration. - `requirements.txt` lists dependencies. - `.env.example` documents required configuration. - `templates/index.html` and `static/styles.css` provide the demo interface. - The example repository is available at `gitlab.com/omid-blogs/gitlab-feature-flags-demo`. ## How the Unleash Integration Works - GitLab provides an Unleash-compatible API for each project, so no separate Unleash server is required. - The SDK downloads flag definitions when the application starts. - It refreshes the cached configuration periodically; the demo uses a 15-second interval. - Calls to `is_enabled()` evaluate flags locally, avoiding a network request for each check. - Local evaluation makes flag checks fast and more resilient to temporary connectivity problems. ## Creating Feature Flags The tutorial creates four active flags, initially using the **All users** strategy: - `dark_mode` enables a dark color scheme. - `holiday_banner` displays a festive banner. - `new_layout` changes the card grid to a single-column layout. - `fun_fonts` applies a playful handwritten font. A flag must be both **Active** and assigned at least one strategy. An active flag without a strategy is evaluated as disabled. ## Choosing Rollout Strategies GitLab supports several built-in strategies: - **Percent rollout:** Gradually enables a feature based on user ID, session ID, or random assignment. - **Percent of users:** Targets a percentage of authenticated users. - **User IDs:** Limits access to explicitly named users, useful for QA. - **User list:** Enables a feature for a predefined user group. - **All users:** Enables the feature for everyone. A typical release process is to begin with QA users, move to a 10% rollout, and eventually enable the feature for all users entirely through GitLab’s UI. ## Configuring Unleash Credentials From the project’s Feature Flags page, the **Configure** panel provides: - `UNLEASH_URL`, such as `https://gitlab.com/api/v4/feature_flags/unleash/<your-project-id>` - `UNLEASH_INSTANCE_ID`, a project-scoped read-only token - `UNLEASH_APP_NAME`, used to identify the application, for example `production` The Instance ID can read flag state but cannot modify flags. It should still be treated as a secret because it can expose project flag information. ## Running the Application Locally - Install dependencies with: ```bash pip install -r requirements.txt ``` - Copy `.env.example` to `.env` and replace the placeholders with the GitLab credentials. - Export the variables from the `.env` file or define them directly in the terminal. - The three environment variables driving the integration are: - `UNLEASH_URL` - `UNLEASH_INSTANCE_ID` - `UNLEASH_APP_NAME` - Never commit `.env`; the repository’s `.gitignore` excludes it because the Instance ID is sensitive. The recommended approach is to use the `UnleashClient` Python SDK to handle polling, caching, and local feature-flag evaluation, while GitLab remains the control center for changing rollout behavior.

api-integrationgitlabpythonfeature-flags+4

stripeMar 12, 2026

10 things we learned building for the first generation of agentic commerce (opens in new tab)

AI-driven commerce is emerging quickly, but making it reliable requires much more than adding an AI checkout button. Sellers must manage fragmented catalog integrations, real-time inventory and variant data, evolving protocols, secure payment tokens, fraud detection, fulfillment, and post-purchase operations. The central recommendation is to use adaptable infrastructure and begin with a limited, measurable product selection rather than launching an entire catalog at once. ## Catalog Integration and Data Quality - Product catalogs are the entry point for AI agents, but each agent may require a different format, such as: - SFTP file drops - Custom APIs - Agent-specific feed specifications - Reformatting the same catalog for multiple agents creates a costly maintenance burden. - Reliable “ingestion-ready” data determines whether products appear consistently across AI shopping surfaces. - A shared commerce layer can syndicate one catalog across supported agents and eliminate duplicate integrations. ## Real-Time Inventory and Product Variants - Agents need to verify current availability immediately before presenting checkout options. - Inventory becomes harder to manage when products include combinations of: - Sizes - Colors - Customizations - Variant-specific availability - Checkout APIs must support real-time availability checks and alternative recommendations when a particular configuration is unavailable. - Real-time accuracy is essential for customer trust and brand reputation. ## Protocol Evolution and Compatibility - Agentic commerce protocols are changing rapidly, with new releases adding payment handlers, scoped tokens, discounts, buyer authentication, and transport methods. - Sellers risk creating “zombie integrations” that become obsolete when an AI platform changes direction. - A protocol-agnostic commerce layer can help businesses support standards such as ACP and Google’s UCP without rebuilding their systems for every change. ## Secure Payments Through Shared Payment Tokens - Shared Payment Tokens allow agents to initiate payments with a buyer’s permission without exposing payment credentials. - The token layer connects AI agents to existing payment rails while limiting transaction scope. - Agentic commerce requires more than payment authorization; systems must also support: - Product discovery - Checkout state management - Shipping - Returns and refunds - The broader infrastructure must cover the full transaction lifecycle. ## Fraud Detection Without Human Browser Signals - Traditional fraud tools often depend on signals such as mouse movements, browser fingerprints, device details, and window size. - Those signals disappear when an AI agent performs the transaction. - Network-level payment history can provide risk context even when a purchase is new to a particular seller. - Shared Payment Tokens allow fraud systems such as Radar to evaluate agentic purchases similarly to traditional checkout transactions. - Early deployments with major retailers reportedly experienced fraud rates near zero. ## Start with a Focused Product Selection - Sellers should avoid enabling their entire catalog immediately. - A practical launch strategy is to: - Select a small group of high-conversion SKUs - Use simple products with direct-to-home fulfillment - Monitor conversion, inventory behavior, payment methods, and fulfillment issues - URBN initially focused on popular categories such as dresses and denim rather than its full range, which also includes complex products like plants and custom furniture. - Early launches should function as controlled experiments that produce data for broader expansion. ## A Strategic Shift in Retail Discovery - Agentic commerce moves buying intent from stores, websites, and branded mobile apps onto AI platforms. - This changes how sellers must approach: - Product discovery - Brand control - Trust - Dispute resolution - The relationship between the seller and customer - Agents increasingly mediate product selection and purchase decisions, requiring sellers to adapt their commerce strategy beyond the traditional storefront. Sellers should treat agentic commerce as an evolving channel rather than a one-time integration. Start with reliable data, a narrow product scope, secure tokenized payments, and infrastructure that can absorb protocol changes before scaling to more products and complex fulfillment scenarios.

api-integrationstripeagentic-commercefraud-detection+4

gitlabMar 5, 2026

Extend GitLab Duo Agent Platform: Connect any tool with MCP (opens in new tab)

GitLab Duo Agent Platform can connect to Jira and other MCP-compatible tools, allowing developers to manage project data through natural-language requests inside their IDE. The post explains how to configure Atlassian OAuth, register Jira as an MCP server, and verify the connection in GitLab and VS Code. It concludes with practical workflows for backlog planning and creating or triaging issues directly from code context. ## MCP Architecture - GitLab Duo Agent Platform operates as the MCP client. - The Atlassian MCP server: - Authenticates users - Converts natural-language requests into Jira API calls - Returns structured results to GitLab Duo - Maintains security and audit controls - This integration reduces context switching between Jira, GitLab, and the IDE. ## Configure the Jira OAuth Application - Create an OAuth 2.0 integration in the Atlassian Developer Console. - Add Jira API permissions: - `read:jira-work` for issues, projects, and boards - `write:jira-work` for creating and updating issues - `read:jira-user` for user information - Configure the callback URL: - `https://gitlab.com/oauth/callback` - Copy the generated Client ID and Client Secret and store them securely. ## Configure GitLab Duo MCP - Create `.gitlab/duo/mcp.json` in the GitLab project. - Register the Atlassian MCP endpoint at: `https://mcp.atlassian.com/v1/mcp` - Configure OAuth authorization and token URLs: - `https://auth.atlassian.com/oauth/authorize` - `https://auth.atlassian.com/oauth/token` - Replace the placeholder credentials with the Jira OAuth values. - Enable **Allow external MCP tools** under **Group Settings → GitLab Duo → Configuration**. ## Verify the Connection - Ask GitLab Duo: - “What MCP tools do you have access to?” - “Test the MCP JIRA configuration in this project” - Approve access on the Atlassian MCP website and select the relevant Jira instance. - Use **GitLab: Show MCP Dashboard** from the VS Code or VSCodium Command Palette to inspect: - MCP server connection status - Available tools such as `jira_get_issue` and `jira_create_issue` - Real-time server logs and tool calls ## Planning and Backlog Prioritization - Query Jira from the GitLab Duo chat without leaving the IDE. - Find unassigned issues in a project. - Ask the assistant to: - Recommend the top issues to prioritize - Summarize their context - Assign selected issues to the current user - This supports sprint planning by combining Jira data with AI-generated prioritization. ## Issue Triage and Creation from Code - Developers can investigate bugs while reviewing code and interact with Jira conversationally. - Example workflows include: - Searching for an existing bug related to a code-level error - Creating a Jira issue if no matching ticket exists - Including relevant code context in the issue - Identifying possible blockers - Linking the issue to the current branch The integration is most useful when teams want Jira actions, planning, and issue management available directly within their development environment. Teams should configure OAuth scopes carefully, protect client credentials, and use the MCP Dashboard to monitor connections and tool activity.

api-integrationmcpnlpai-ml+4

stripeMar 2, 2026

Can AI agents build real Stripe integrations? We built a benchmark to find out (opens in new tab)

State-of-the-art LLM agents can complete many scoped coding tasks, but fully autonomous software engineering remains difficult because real projects require long-term planning, persistent state, debugging, and end-to-end validation. Stripe evaluated this gap through a benchmark of realistic backend, frontend, database, and browser-based integration tasks. The results were stronger than expected: agents demonstrated substantial full-stack capability, but still struggled with ambiguity and the judgment required to distinguish genuine failures from bad test inputs. ## Building the Stripe Integration Benchmark - Stripe created 11 environments based on real integration challenges, including Checkout migrations and Billing API modeling. - Each environment included: - A complete codebase, database, scripts, and test Stripe credentials. - Deterministic graders using API calls, automated browser tests, or inspection of Stripe objects. - A consistent agent harness with terminal, browser, and Stripe-specific search tools through MCP. - Challenges were divided into: - **Backend-only tasks:** SDK upgrades, API changes, and database migrations. - **Full-stack tasks:** Coordinated server and client changes requiring browser verification. - **Gym problem sets:** Focused exercises testing deep knowledge of features such as Checkout and subscriptions. ## Stronger-than-Expected Agent Performance - The benchmark intentionally used fewer, harder tasks designed to expose weaknesses. - Agents successfully: - Navigated browser interfaces. - Debugged live issues. - Worked with underdocumented API behavior. - Continued productively across long interactions, with top runs averaging 63 turns. - Claude Opus 4.5 achieved a 92% average score across four full-stack tasks. - GPT-5.2 achieved a 73% average score across two gym problem sets. - In a migration from Card Element to Checkout, an agent completed and verified a test purchase using Link, despite no payment method being specified. ## Reverse-Engineering Checkout Configurations - A Checkout gym task required agents to infer API parameters from 20 prebuilt Checkout UIs. - Agents had to: - Inspect products and quantities shown in each session. - Locate matching product IDs through the Products API. - Identify shipping costs, custom fields, tax settings, and other customizations. - Translate those details into valid Checkout Session parameters. - Agents provided more than 80% of the correct parameters. - The best-performing agent recognized that one UI’s color options were hidden behind an interactive dropdown, explored the control, and included the missing values. ## Remaining Challenges with Ambiguity - Agents struggled when evaluation situations required judgment rather than straightforward implementation. - In SDK upgrade tasks, some agents supplied nonexistent Stripe data, received expected 400 errors, and treated those responses as evidence that their implementation was broken. - This illustrates a broader limitation: successful autonomous engineering requires not only writing code, but also designing meaningful tests, interpreting failures correctly, and validating behavior against realistic system state. The benchmark suggests that agents are increasingly capable of substantial Stripe integration work, including full-stack implementation and browser-based verification. However, reliable autonomy will require better handling of ambiguity, realistic test data, persistent project state, and rigorous end-to-end validation.

api-integrationstate-managementllm-evaluationdatabase-migrations+4

airbnbJan 12, 2026

Pay As a Local (opens in new tab)

Airbnb launched more than 20 locally preferred payment methods across global markets in just over 14 months. The initiative aimed to improve checkout conversion, reach customers with limited access to cards, and provide familiar payment options. Airbnb achieved this by combining a replatformed, domain-oriented payments architecture with reusable PSP connectors and standardized payment-flow patterns. ## Why Local Payment Methods Matter - Local payment methods (LPMs) include: - Digital wallets such as M-Pesa and MTN MoMo - Online bank transfers - Real-time payment systems such as PIX and UPI - Regional payment schemes such as EFTPOS and Cartes Bancaires - They help Airbnb: - Increase conversion by offering trusted local options - Enter markets where card usage is limited - Serve customers without credit cards or traditional banking access - Airbnb identified more than 300 payment options worldwide. - For the initial rollout, it evaluated the top 75 travel markets and selected one or two methods per market, producing a shortlist of just over 20 integrations. ## Payments Platform Modernization - Airbnb separated payment capabilities from its core stays, experiences, and services businesses. - Its Payments LTA modernization replaced a monolith with domain-oriented services. - Core payment subdomains include: - Pay-in and payout - Transaction fulfillment and processing - Wallets and payment instruments - Ledger - Incentives and stored value - Issuing - Settlement and reconciliation - This structure improved reuse, extensibility, time to market, and team autonomy. ## Connector Architecture and Multi-Step Transactions - The processing domain uses connector and plugin-based integrations for payment service providers (PSPs). - Plugins support: - API- and file-based integrations - Payment routing and switching - Market-specific PSP behavior - Airbnb also introduced Multi-Step Transactions (MST), a PSP-agnostic framework for payments requiring multiple stages. - MST represents intermediate operations as Actions, including: - Redirects to external apps or websites - Strong customer authentication challenges - Payment-method-specific interactions - PSP plugins normalize these requirements into an `ActionPayload` and return an `ACTION_REQUIRED` transaction status. ## Three Standardized LPM Flow Types Airbnb analyzed its payment methods and grouped them into three reusable archetypes: - **Redirect flow:** The guest is sent to an external site or app, then returned to Airbnb. Examples include Naver Pay, GoPay, and FPX. - **Async flow:** The guest completes payment later through a QR code, push notification, or wallet app, while Airbnb receives confirmation through a webhook. Examples include Pix, MB Way, and Blik. - **Direct flow:** Payment credentials are entered within Airbnb and processed immediately, similar to card payments. Examples include Cartes Bancaires and Apple Pay. This classification reduced duplicate engineering work and made new integrations more predictable. ## Orchestrating External Payment Actions - For redirect payments: - Airbnb sends a charge request to the local vendor. - The vendor returns a `redirectUrl`. - The guest completes payment externally. - Airbnb receives a result token and uses it to confirm the transaction securely. - For asynchronous payments: - Airbnb sends a charge request and receives `qrCodeData`. - The checkout displays the QR code. - The guest pays in an external wallet. - The vendor sends a webhook, allowing Airbnb to mark the payment successful and confirm the order. - These flows required careful handling of app switching, session handoff, delayed confirmation, and synchronization between Airbnb and external providers. ## Outcome Airbnb’s rollout demonstrates that broad local-payment coverage depends less on building every integration independently and more on creating reusable abstractions. A modular payments platform, standardized flow archetypes, normalized PSP actions, and plugin-based connectors enabled the company to support diverse regional payment behaviors at global scale.

api-integrationmicroservicessoftware-architecturewebhooks+3

discordJul 20, 2025

ROOST Announces “Coop” and “Osprey”: Free, Open-Source Trust and Safety Infrastructure for the AI Era (opens in new tab)

ROOST, a non-profit dedicated to digital safety, has launched two open-source tools, Coop and Osprey, to provide enterprise-grade content moderation and threat investigation capabilities to organizations of all sizes. By open-sourcing technology previously developed by industry leaders like Discord and Cove, ROOST aims to democratize access to the infrastructure required to detect, triage, and respond to online harms. This initiative shifts Trust and Safety from a proprietary competitive advantage to a shared public resource, enabling platforms to prioritize user protection without the burden of expensive enterprise software. ### Content Review and Compliance with Coop Built on technology acquired from Cove and utilized by platforms like Notion, Coop focuses on the human-in-the-loop aspect of content moderation. * The platform provides robust tools for content review, allowing teams to route specific cases to subject-matter experts for deeper analysis. * It includes built-in integration with the National Center for Missing & Exploited Children’s (NCMEC) API, automating the mandatory reporting process for child sexual abuse material (CSAM). * The interface is designed to surface relevant context and metadata, ensuring moderators can make informed decisions and take immediate action against policy violations. ### Incident Response and Investigation with Osprey Osprey is a lightweight investigation tool originally developed by Discord to manage large-scale safety incidents and platform-wide threats. * It serves as a foundation for incident response, helping safety teams understand platform trends and investigate coordinated threats like phishing or harassment campaigns. * The tool is designed to be user-friendly and accessible for grassroots communities while remaining powerful enough for established platforms. * Early adopters, including the decentralized social network Bluesky, are implementing Osprey to demonstrate that effective safety infrastructure can be scalable and resource-efficient. ### A Collaborative Model for Safety Infrastructure The launch of these tools represents a strategic shift toward a collaborative "public-interest" model for digital defense. * ROOST acquired the intellectual property of Cove and received the donation of Osprey from Discord to ensure these tools remain available as a public good. * The initiative is backed by philanthropic funding and legal support from Perkins Coie, removing the financial barriers that often prevent smaller platforms from implementing high-level safety measures. * Major industry players like Notion and Bluesky are championing the move, signaling an industry-wide push to share safety innovations rather than silo them. Platforms and developers should prepare to integrate these tools into their safety stacks as they become publicly available in the coming months. By adopting open-source infrastructure for routine tasks like NCMEC reporting and incident triage, organizations can focus their internal resources on platform-specific innovations while maintaining a high standard of digital safety.

api-integrationopen-sourceincident-responsetrust-and-safety+3

figmaJun 4, 2025

Double Click: What Does MCP Mean for Agentic AI? | Figma Blog (opens in new tab)

MCP is emerging as a common interoperability layer between AI assistants and external tools or data sources. By allowing models to discover and invoke tools during a conversation, it can make agentic systems faster, more scalable, and less dependent on bespoke integrations. The growing ecosystem—including Figma’s own MCP server—suggests MCP could become foundational infrastructure for the agentic web. ## What MCP Is - Anthropic introduced the Model Context Protocol in November, 2024; support from OpenAI helped drive widespread adoption. - MCP standardizes how assistants such as Claude, Copilot, and Cursor communicate with tools and data. - Developers can avoid building separate custom integrations for every AI assistant and service. - The protocol is compared to: - **USB-C**, as a universal connection for AI applications. - **HTTP**, because it is lightweight, composable, interoperable, and largely unconcerned with the payload. - Microsoft CTO Kevin Scott described MCP as a potential backbone for agent communication and evolution. ## MCP and Agentic AI - MCP gives large language models real-time access to tools and information. - This enables AI agents to act on a user’s behalf rather than merely generate text or code. - The number of available MCP servers is growing rapidly. - Figma created an MCP server that connects design information directly to developer workflows, supporting design-informed code generation. ## MCP as an Accelerant - Traditional API-based workflows often require an LLM to generate code and execute it whenever it needs to interact with a tool. - With MCP, the model can recognize available tools and invoke them directly during a conversation. - This reduces friction and improves speed, efficiency, and scalability. - The resulting experience makes complex actions feel more immediate—users can increasingly “just do things.” ## Early Examples of MCP Use - An automated AI travel agency used four agents across Google Maps, Airbnb, Google Calendar, and Weather. - A Blender MCP server generated a 3D scene of a low-poly dragon guarding treasure from a few natural-language instructions. - Y Combinator hosted a large MCP hackathon, demonstrating the rapid growth of experimentation around the protocol. MCP’s main promise is not simply connecting AI to APIs, but creating a shared, extensible standard that lets agents use many tools dynamically. Its long-term impact will depend on how reliably and responsibly these increasingly capable systems operate.

api-integrationfigmallmai-agent+2

figmaMar 10, 2020

Extend what’s possible with plugins for you and your team | Figma Blog (opens in new tab)

Figma’s post argues that plugins can turn repetitive, team-specific design tasks into fast, reusable workflows. Examples from GitHub, Atlassian, and Uber show how teams use plugins for component management, theming, realistic content, critique, and collaboration. The conclusion is that when no public plugin fits a specialized need, teams should build bespoke tools—and potentially combine them into a unified plugin. ## Building a Unified Plugin at GitHub Brian Lovin began creating plugins at GitHub after noticing how much time designers spent on repetitive operations. - A **borders utility** toggled the visibility of divider layers within list-item components. - This allowed GitHub to maintain one flexible component instead of multiple components for every divider size and placement. - A **color-theming plugin** helped designers manage light, dark, and high-contrast themes. - It searched functionally named styles and quickly switched entire designs between themes. - A **data population plugin** pulled live API data into designs. - It mapped avatars, usernames, and names to appropriately named component layers. - These tools were consolidated into a single “mono plugin,” giving the team one interface for several workflow improvements. ## Product-Specific Content at Atlassian Atlassian created the **ADG Data Generator** to prevent designers from using generic or misleading placeholder content. - Designers can generate data appropriate to specific products: - Jira projects and ticket numbers - Bitbucket branches and commit messages - The plugin keeps related content logically connected, such as matching project names with project descriptions. - For user imagery, it generates realistic but entirely artificial faces instead of using stock photos of real people. - Atlassian shared the generator’s source code with the broader community. ## Collaboration and Critique at Uber Uber’s design team developed more than four plugins to improve collaboration, consistency, and speed. - A **mobile design critique plugin** creates a QR code and URL for the selected Figma frame. - Critique participants can open the design on their own phones and experience it at the intended mobile scale. - This gives each reviewer a better sense of how the design feels in-hand than viewing it on a shared large screen. ## A Pattern for Identifying Plugin Opportunities The examples show that useful plugins often emerge from recurring friction rather than from abstract experimentation. - Look for repetitive tasks that require many clicks. - Target workflows tied to a company’s own products, components, data, or design system. - Automate tasks involving large sets of styles, layers, or content. - Combine related utilities into one accessible team tool when multiple plugins begin to accumulate. Teams should start by identifying a specific, repeated workflow problem and build the smallest tool that removes it. Over time, those focused tools can become a broader internal plugin tailored to the team’s design system and processes.

api-integrationdesign-systemsaccessibilityfigma-plugins+3

figmaMar 26, 2019

Dribbble Scores with Live Design Collaboration for its Remote Team | Figma Blog (opens in new tab)

Dribbble adopted Figma to make collaboration feel more like working together in the same room despite its fully remote, globally distributed team. Figma replaced a fragmented collection of tools with a shared, real-time workspace and a single source of truth for designs. The result was faster iteration, clearer feedback, and less time spent managing files and communication. ## Remote Collaboration Challenges - Dribbble’s design team included seven product designers and developers working across multiple time zones. - Remote work helped attract talent and offered flexibility, but made spontaneous collaboration more difficult. - The team relied on video conferencing and several disconnected tools, without a seamless way to work together. - Designers lacked visibility into one another’s work, while file management and multiple feedback channels reduced time available for design. ## Figma as a Shared Design Workspace - Figma allowed multiple people to work in the same file simultaneously, recreating the experience of brainstorming in a room or on a whiteboard. - Online files were easier to find and access, eliminating the need to ask colleagues for the latest version. - Designers could stay within one tool instead of repeatedly switching between applications. - Figma’s handling of vectors, images, and copy-paste attributes also appealed to Dribbble’s designers. - The team eased adoption by importing existing design files and recreating familiar interface components in Figma. ## Faster Pairing and Feedback - Figma supported Dribbble’s practice of using design pairs to solve problems and deliver products quickly. - A single, current file reduced communication friction and kept designers aligned on the latest changes. - Multiplayer editing made it easier to hold frequent critiques, duplicate frames, explore alternatives, and comment in real time. - The team could solve design problems in minutes rather than days; in one example, five people collaboratively produced an approved profile design in about 20 minutes. ## Integration with Dribbble - Dribbble used Figma’s API to build an integration for publishing work directly to Dribbble. - Users can select a layer in Figma and choose **Integrations → Dribbble** to begin the Dribbble desktop upload flow. For fully remote design teams, a shared real-time workspace can replace fragmented collaboration processes. Dribbble’s experience suggests that adopting a single source of truth helps teams communicate more clearly, iterate faster, and spend more time designing.

api-integrationfigmadesign-systemsreal-time-collaboration+3

figmaOct 1, 2018

Introducing: Figma’s first API Challenge | Figma Blog (opens in new tab)

Figma announced a $15,000 API challenge to encourage developers to build an open-source Figma-to-Sketch converter. The contest reflected Figma’s goal of supporting an open design ecosystem, even when that meant exporting files to a competitor. However, after community concerns, Figma paused the challenge and ultimately cancelled it in November 2018. ## Open Design Platform and API Challenge - Figma wanted to make it easier for designers to move projects between tools. - The challenge focused on building a Figma-to-Sketch exporter using Figma’s read API. - Figma positioned this as a natural extension of its existing Sketch import support. - The company was also responding to community-built API projects, such as style-guide generators and Alexa integrations. - Future challenges were intended to reward developers who open-sourced useful Figma integrations. ## Evaluation Criteria - Submissions had to export two test files: - A basic file containing common Figma objects. - A more complex file involving typography, components, styles, and prototypes. - The basic file was expected to have clearer correctness criteria. - The advanced file required subjective judgment because Figma and Sketch do not always have equivalent one-to-one features. - Judges would consider: - Accuracy of the exported designs. - Ease of use. - Creativity in translating incompatible features. - Code quality and GitHub documentation. - Code quality and documentation accounted for 5% of the score. ## Rules, Prizes, and Submissions - First place would receive $10,000; second place would receive $5,000. - Teams could include up to three people. - Entrants generally had to be over 21 and located in an eligible country. - Projects were submitted through a Google Form. - Each project needed a GitHub repository containing a README and MIT License. - The planned contest period was October 2 through November 16, 2018. ## Judges and Community Focus - The judging panel combined design expertise with experience building tools and community resources. - Members included Emily Plummer, Raph D’Amico, Cat Noone, and Roy van Rooijen. - Their backgrounds covered design systems, interaction design, accessibility tools, plugins, and design-tool development. ## Cancellation - Figma initially announced that the challenge would be paused and potentially relaunched after community feedback. - On November 19, 2018, the company said it would not proceed with any version of the challenge at that time. The challenge demonstrated Figma’s ambition to promote interoperability and an open platform, but its eventual cancellation showed the importance of addressing community concerns before incentivizing integrations involving a direct competitor.

api-integrationdesign-systemsreactopen-source+4