Build with an agent

These docs are written to be read by coding agents as well as people. Every page is plain Markdown at its own address plus .md, and the whole set is gathered in a few files agents can fetch in one go.

File	What’s in it
/llms.txt	The map: what Proof is, and links to the sets below
/llms-full.txt	Every page, in full
/llms-small.txt	Every page, with examples and asides trimmed
One file per section	Concepts, guides, the REST API, and the rest of the reference, linked from llms.txt
/<page>.md	One page, e.g. /quickstart.md

Each page also has a Copy as Markdown button under its title, for pasting one page into a chat.

A prompt that adds Proof to your app

Paste this into Claude Code, Codex or your agent of choice from the root of your project. Put a test key in your environment first, so the agent never needs to see it.

prompt.txt

Add the Proof of Thought editor to this app using the Proof API.

Read https://developer.proof.exalto.ai/llms-full.txt first. Then:

1. Install @exalto/proof (server) and @exalto/proof-embed (browser).
2. Keep every Proof call on the server, with the key from PROOF_SECRET_KEY.
   Never send the key to the browser.
3. Add a proof_user_id column to our users. When a user signs up or changes
   their name or picture, PUT them to /v1/users/external/{our user id} and
   store the Proof id it returns.
4. Store a Proof document id beside each of our documents. Create the Proof
   document when ours is created, with our user's Proof id as owner.
5. Add a POST route that checks our own session and permissions, then creates
   a Proof editor session for that user and document and returns the token.
6. Mount the editor where we show a document, with getToken calling that route.
7. Add a webhook route that verifies the Proof-Signature header and logs events.

Use our existing auth, routing and styles. Show me the plan before writing code.

Adjust step 4 to how your app stores documents. If your app already has sharing, ask the agent to mirror it into members as well.

Keep the docs in reach

Add a line to the instructions file your agent reads (CLAUDE.md, AGENTS.md or similar), so it checks the docs instead of guessing:

AGENTS.md

## Proof
We embed the Proof of Thought editor. Before changing anything that calls the Proof API,
read the relevant page from https://developer.proof.exalto.ai/llms.txt (each page is also at
its path plus .md). Use test keys (sk_test_) locally; never log or expose PROOF_SECRET_KEY.

Things agents tend to get wrong

• Calling Proof from the browser. Everything but the editor itself goes through your server. The browser only gets editor session tokens.
• Treating Proof as the account system. Proof has no sign-in. Your session check comes first, then the Proof call.
• Passing your own ids where Proof ids go. Your id for a user goes in one place, PUT /v1/users/external/{external_id}. Everything else takes the Proof id (usr_…) that call returns, so store it beside your user.
• Skipping signature checks on webhooks. Verify Proof-Signature before trusting an event. The Node SDK’s proof.webhooks.verify does it in one call.
• Mixing up the two MCP servers. Your users’ agents connect to mcp.proof.exalto.ai/<your slug> to work in documents. That is a feature for your users, not a tool for building your app.