llms.txt |
Two paths, one API. Paste our llms.txt into Cursor, Claude Code or ChatGPT — or build real browser apps with Publishable Keys. No SDK, no backend, no CORS hell.
Copy. Paste. Ship code.
Paste llms.txt into Cursor, Claude Code, Windsurf or ChatGPT — the AI writes working integrations. Python, Node, Go, you name it.
AI-Canvas apps with real API calls.
Build single-file React apps that hit our API straight from the browser — in Claude Artifacts, ChatGPT Canvas, Gemini or Grok. Stripe-style Publishable Keys (po_pk_) — scope-limited, budget-capped, origin-locked.
Trusted by leading companies worldwide
Only official DMS
Built for AI, not Postman.
The Postman Collection is 1.5 MB of JSON optimised for the Postman/Insomnia/Bruno apps. llms.txt is pure Markdown — a format every LLM reads natively.
Postman Collection
~1.5 MBImport into Postman, Insomnia, Bruno — click-to-test, debugging, team sharing.
Go to Postman →llms.txt (Hub)
~53 KBShort index — paste into AI for quick lookups, endpoint discovery, category overview.
llms.txt →llms-full.txt
~780 KBEvery endpoint with params, response samples, error codes — the one you paste when building real integrations.
llms-full.txt →Example prompts
These prompts work in Claude, Cursor, Windsurf, ChatGPT, Gemini and every other coding AI. No SDK, no boilerplate.
Read this API documentation:
https://api.paperoffice.ai/latest/docs/llms-full.txt
Write a Python function that takes a PDF file and returns the extracted OCR text.@Docs https://api.paperoffice.ai/latest/docs/llms-full.txt
Build a FastAPI endpoint that classifies uploaded invoices using /documentai/classify.You have access to the PaperOffice API. The full spec is at:
https://api.paperoffice.ai/latest/docs/llms-full.txt
Use a Bearer token in the Authorization header. Start by authenticating, then process the user request.Every AI speaks llms.txt.
Markdown is the native language of modern LLMs. Drop the URL into any tool that reads docs — no extensions, no plugins.
Zero trust required — the rules are set in concrete.
Publishable Keys are built to stay safe even when someone copies them straight out of your AI-canvas artifact source code.
Dangerous endpoints hardcoded off
DELETE methods, admin, billing, webhooks and token-management are hardcoded-blocked — regardless of scope.
Budget cap acts instantly
When the lifetime credit limit is hit: HTTP 402 BUDGET_EXHAUSTED. Not a single credit more.
Redis-backed rate limiting
Sliding-window per token. Exceeding it returns HTTP 429 — protects your credit pool from abuse.
Origin header mandatory
The browser sets it automatically. Server-to-server abuse of a leaked po_pk_ is therefore impossible.
Instant revoke
Hit "Revoke" in the dashboard — the Redis cache is invalidated on the spot. A compromised key is dead in milliseconds.
Scopes toggle granularly
Each scope can be flipped on or off individually in the dashboard. Least-privilege without workarounds.
From zero to working code in 30 seconds
Copy the URL
Grab llms-full.txt for complete specs or llms.txt for a slim index.
Paste into your AI
Claude fetches URLs automatically. Cursor has @Docs. ChatGPT browses it. Paste, done.
Prompt and ship
The AI understands every endpoint, auth, pricing and error code. It writes working integrations end-to-end.
ReadyEverything you need to know about Publishable Keys.
Does this really only work in Claude Artifacts?
No — po_pk_ works in every modern AI canvas platform: Claude Artifacts, ChatGPT Canvas, Gemini (Canvas & Gems), Grok Workspaces and any browser-hosted environment like v0.dev, Bolt.new, StackBlitz or CodeSandbox. The four AI origins are whitelisted by default; you can also register your own domain.
How is po_pk_ different from po_sk_?
po_sk_ (Secret Key) is meant for server-to-server integration — full access to the entire API, never put it in the browser. po_pk_ (Publishable Key) is built for browser code: scope-limited to explicitly allowed endpoint groups, with a lifetime credit cap and origin lock. A po_sk_ inside an AI-canvas artifact would be a total wipe-out — a po_pk_ is by design bounded to the expected damage.
What happens if my po_pk_ becomes public?
The damage stays contained: origin lock blocks use on foreign domains, the budget cap caps spend, rate limiting slows scrapers. Click "Revoke" in the dashboard — the Redis cache is invalidated instantly and the key is dead in milliseconds.
Can I configure my own origins, like my-company.com?
Yes. When creating the key you can set a list of allowed origins. The WIDGET preset is built for exactly this: list your own company website as an origin and embed the widget directly.
How do I set the credit budget for my app?
When creating the key you pick a lifetime credit limit (default: 1,000, AIDEMO: 2,000, WIDGET: 5,000). Once hit, the API returns HTTP 402 BUDGET_EXHAUSTED. You can adjust the budget anytime from the dashboard — no need to rotate the key.
Is po_pk_ billed differently from po_sk_?
No. Every API call pulls the same credits from your main account — whether via po_sk_, po_ut_ or po_pk_. The po_pk_ budget cap is an extra safety net, not a separate pricing tier.
Which endpoints are off-limits for po_pk_?
All DELETE methods and every admin, billing, webhook and token-management endpoint is hardcoded-blocked — regardless of what you select in scope. It is therefore technically impossible to delete data, read billing info or create new tokens with a po_pk_.
Fewer tokens, cheaper prompts, no JSON boilerplate — llms.txt is pure content for pure AI reasoning.
Ready to prompt?
Copy, paste, ship — in your IDE or straight in the browser. Two paths, one API, no lock-in.