Quickstart

From an empty account to your first score, in three HTTP calls.

1. Get an API key

Sign in to the dashboard (email sign-in link, or a Google/GitHub account).
Open the "API keys" section and generate a key.
Copy it right away: it starts with ar_live_ and is shown only once.

An API key is a secret, and it costs real money

An API key grants access to your quota, and therefore to real costs. Store it as a CI secret, never in a versioned file. If you lose it, revoke it and generate a new one — it cannot be shown again.

You don't need a key to try the tool: the playground on the site runs a free audit with no account. A key is for automated integration, and it's what unlocks the agent simulation.

2. Create an audit

bash

curl -X POST https://api.canagentsbuyfromyou.com/audits \
  -H "Authorization: Bearer $CABFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"business": "https://my-store.com"}'

The response is immediate — 201, with the job id. The audit itself runs in the background: expect anywhere from a few seconds to a few minutes depending on the checks requested.

json

{ "id": "b3f1e2a0-...", "status": "pending" }

3. Wait for it to finish

There's no webhook yet, so you poll. A three-second interval is a good compromise.

bash

until curl -sS https://api.canagentsbuyfromyou.com/audits/$AUDIT_ID \
  | tee /tmp/audit.json | grep -q '"status":"done"'; do sleep 3; done

The status field goes pending, then running, then done — or failed if the audit couldn't complete.

4. Read the result

bash

curl -sS https://api.canagentsbuyfromyou.com/audits/$AUDIT_ID | jq '.result.overall_score'

For an anonymous audit, the same id gives you the HTML report at /audits/{id}/report. Account audits require an API key or an authorized workspace session; use a revocable share link to send a report to someone else.

The same calls, in your language

# Steps 2 to 4 above, in one go.
AUDIT_ID=$(curl -sS -X POST https://api.canagentsbuyfromyou.com/audits \
  -H "Authorization: Bearer $CABFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"business": "https://my-store.com"}' | jq -r '.id')

until curl -sS https://api.canagentsbuyfromyou.com/audits/$AUDIT_ID \
  | tee /tmp/audit.json | grep -q '"status":"done"'; do sleep 3; done

jq '.result.overall_score' /tmp/audit.json

The whole round trip: create, wait, then read the score.

What's next

For a CI pipeline, don't reimplement that loop: the command line already does it, with the blocking threshold and automatic commit/branch detection.

bash

npx cabfy audit https://my-store.com --fail-under 60