Payments tools

Payment tools let the agent take money. Both providers below are outbound-only — for inbound webhooks (payment received, refund completed, etc.) you wire the provider directly to your own endpoint.

Stripe

Tool id: stripe. Credential type: stripe.

Actions: create_payment_intent, retrieve_payment_intent, confirm_payment_intent, create_customer, retrieve_customer, list_customers, create_payment_link, create_refund, get_balance.

Get the API key

1. Open dashboard.stripe.com/apikeys.
2. Decide test or live: test keys (sk_test_…) for development; live keys (sk_live_…) for production. The credential validator reports which mode it detects.
3. Click Create restricted key (recommended) — pick only the permissions the agent needs: e.g. Customers: Write, Payment Intents: Write, Payment Links: Write.
4. Copy the secret key and save it as a Stripe credential.

Typical agent recipe — payment link

Customer in chat: “Can you send me a payment link for $250?” → agent calls create_payment_link with line_items and an idempotency key, returns the URL, agent drops it in the reply.

M-Pesa STK Push

Tool id: mpesa_stk. Credential type: mpesa.

Send an STK Push request to a customer's phone so they authorise payment with their M-Pesa PIN. Actions: stk_push, query_status.

Get the credentials (sandbox first)

1. Sign up at developer.safaricom.co.ke.
2. Create a new sandbox app, pick the Lipa Na M-Pesa Online Payment API.
3. Copy the Consumer Key, Consumer Secret, the test Shortcode (174379), and the test PassKey.
4. Save them as an M-Pesa credential. Set environment = sandbox.

Going live

1. Have your business registered with Safaricom and a Paybill or Till number issued.
2. Go through the “Go Live” flow on the developer portal — Safaricom reviews the use case and signs off.
3. After approval Safaricom hands over the production Consumer Key / Secret / PassKey. Update the credential to environment = production.

Callback URL

STK Push is asynchronous. The customer's reply (success / fail) comes to a callback URL you supply on the credential. Use a URL that's reachable from Safaricom (public HTTPS) — for testing, an ngrok tunnel or webhook.site works.