Changelog
What changed in the API, the SDKs and the agent files, newest first.
2026-10-31
AgentPay names on the developer surface. The packages are @agentpay-global/sdk, @agentpay-global/mcp and PyPI agentpay-global (import agentpay), all at 0.3.0. The skill is agentpay, the repository is Kato-Official/agentpay-skills, the key variable is AGENTPAY_API_KEY (JOOMJOO_API_KEY is still read). The get-agentpay names on npm and PyPI are mirrors that install the real packages. The old @joomjoo/* and joomjoo packages stay published, untouched.
2026-10-30
The first card at onboarding. A new account's first card is issued at signup, single use, loaded with the signup gift. GET /v1/wallet gained cards_ready, ready_to_spend, charges_in_flight, after_settlement and note, so an agent reading the wallet knows a checkout whose total fits an open card pays with it, and that an authorized charge still settling is not a failed purchase.
2026-10-24
The AgentPay passkey. On merchants that take passkeys, AgentPay enrols its own after the person's one sign-in, and every later checkout signs in by itself. Connections report layer, passkey_status, remote_removal and passkey_connected_at. A checkout reports login_layer. New: POST /v1/connections/{id}/passkey with action: "skip", and DELETE /v1/connections/{id}. needs_login now carries login_check (signed_out, unknown, passkey_password).
2026-10-20
The person's own card. POST /v1/cards/connect returns a one-hour link where the cardholder connects their own card behind a passkey. GET /v1/cards lists connected (source: "own") and issued (source: "issued") cards. DELETE /v1/cards/{id} removes a connected one. own_card_id on POST /v1/checkout pays with it after the cardholder approves on their phone: status needs_card_approval, fields approval_url and approval_expires_at, event checkout.needs_card_approval.
2026-09-29
Continue from the basket. resume_of on POST /v1/checkout continues an ended run that left its own items in the basket. 409 not_resumable when there is nothing to continue from. A completed connection now counts as the person's confirmation, so a signed-in page with no visible sign-out control no longer reads as unknown.
2026-09-26
The wallet over the API. GET /v1/wallet, POST /v1/wallet/funding-sessions (a Stripe page for card or stablecoin) and POST /v1/wallet/bank-transfers (a declared transfer with the account and reference code). New event money.funded. Webhook headers are sent under both Joomjoo- and Mooj- names.
2026-09-25
Checkouts start where the console's do. A developer's checkout now uses the account's stored merchant logins, the cards-a-month wall, the paused-agent rule and the late card mint. confirm_pay in the response says what was granted. New errors: site_required, site_ambiguous, agent_required, plan_limit, agent_paused, busy. idempotency_key on a checkout returns the same run on a retry.
2026-08-20
Key expiry. A key can be given an expiry at creation. An expired key answers 401 expired_api_key with expired_at, never "invalid".
2026-07-18
Webhooks and SDKs. Signed webhook deliveries for card.authorized, card.cleared, card.declined, checkout.submitted, checkout.needs_login and checkout.blocked. First Node and Python SDKs and the MCP server.
2026-07-17
The developer API. POST /v1/cards, GET /v1/cards/{id}, POST /v1/cards/{id}/close, GET /v1/spend/{id}, POST /v1/checkout, GET /v1/checkout/{id}, POST /v1/connections, POST /v1/connections/{id}/complete, GET /v1/connections, GET /v1/connections/{id}. Bearer mk_live_ keys from the console.