Offer a service

What a service is for#

Most tools should be free extensions. A service is for cases where every run costs you real money, such as a paid data API, heavy compute or a licensed corpus. Giving it away per run would mean paying to be used. Services are priced in credits, per run, and the member's agent offers them in chat with the price shown before anything is spent. What that looks like from the member's seat is shown on Earn. This page covers the provider's side.

The shape of a run#

The platform is the intermediary, and the whole exchange is one HTTP round trip: it spends the member's credits atomically, forwards the caller's JSON to your endpoint with a signature, and relays your JSON answer verbatim. JSON in, JSON out, up to a minute, with no streaming. Version 1 is sized for research-and-answer services rather than live feeds. You never handle the user's identity (you are never told who ran it) and their money (credits are the platform's ledger, not your checkout).

POST /your-endpoint HTTP/1.1
content-type: application/json
x-intentic-timestamp: 1791234567
x-intentic-signature: 3f1a9c…   # HMAC-SHA256 over "{timestamp}.{body}"

{ "query": "which subreddits fit a self-hosted agent workspace?" }

HTTP/1.1 200 OK
content-type: application/json

{ "communities": [ … ], "timing": "…", "confidence": 0.82 }

Verify the signature#

What you get instead of issuing API keys: every forwarded call carries x-intentic-timestamp and x-intentic-signature, an HMAC over {timestamp}.{body} with the secret you were issued at onboarding. It uses the same scheme as Stripe webhooks. Verify it and drop everything else, and nobody can run up your upstream bill but the platform. The timestamp check makes a replayed capture die of old age.

import { createHmac, timingSafeEqual } from "node:crypto";

// x-intentic-signature = HMAC-SHA256(secret, "{timestamp}.{body}"); reject anything older than a few minutes.
export function verifyIntenticSignature(body: string, timestamp: string, signature: string, secret: string): boolean {
    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
    const expected = createHmac("sha256", secret).update(`${timestamp}.${body}`).digest("hex");
    const a = Buffer.from(signature, "utf8");
    const b = Buffer.from(expected, "utf8");
    return a.length === b.length && timingSafeEqual(a, b);
}

What's paid, what refunds#

The line is whether you answered, not whether the caller liked the answer:

• Any completed response below 500 is served. That includes your 4xx. "Your query was malformed" is an answer, so the member pays for it and receives it verbatim. Validate loudly; it is the paid, honest thing to do.
• A 5xx, a timeout or a dead socket refunds automatically. Credits were spent atomically before the call and come straight back; the member is told the run cost nothing. You are not paid for failing to serve.

Pricing & the split#

You publish one number: credits per run. Every surface shows it before the run, and a refusal for lack of credits tells the member what's left and when it resets. Price your real cost plus margin, not a teaser. 90% of every spent credit's dollar value is yours; the split, your run counts and your earnings are on the public ledger, per service, for anyone to read. Earn explains what a credit is worth and why the model is unfarmable.

Admission & the watch#

Extensions pass an automated code audit because their code runs in somebody's browser and sandbox. A service has nothing to put through that pipeline (no code of yours ships to anyone), so the gate is a different kind: admission is curated. In v1 every row in the catalog is created by the platform after a human review of who you are, what the listing claims, and whether the price fits the shape. There is no form that puts an endpoint in front of members' agents unreviewed.

After admission, the watch is behavioral, because with a service, behavior is the artifact:

• Every run is on the ledger. Your service's runs, credits and earnings are public, month by month. A track record is not something either of us can dress up.
• The mechanical case never becomes a dispute. No answer, no charge: the refund is the platform's code, not a support queue, so the commonest conflict resolves itself before anyone argues.
• Quality is a delisting question, not a chargeback. A served answer is paid even when it disappoints. A service that keeps disappointing is switched off: removed from the catalog with its run history kept, the same way a bad extension listing is blocked.

And the member keeps their own guard the whole way through: the agent only discovers. It offers from this curated catalog, and nothing is spent until the owner says yes to a priced run. Discovery is the agent's job, admission is the platform's, spending stays the member's.

Getting onboarded, honestly#

There is no self-serve provider signup yet: the first services are onboarded by hand, which buys each one a real conversation about pricing and shape. Bring an endpoint that answers the exchange above and say hello on Discord. You'll leave with a secret and a listing. The catalog's own demo-research service is the living reference: its upstream is run by the platform and verifies exactly the signature on this page, so what this page documents is what the forward actually sends.

Related pages

• Earn: the economy your price plugs into, and the chat flow your service is offered in.
• Publish & registries: shipping a free, unmetered extension instead.