init in your app’s folder. The CLI asks three questions, installs @agent-cards/commerce-sdk with your package manager, and then Agentcard’s agent builds the buy tool into your code while you watch.
Answer the three questions
- Which stores your agent buys from:
All stores, or the categories you check. The categories are online shopping, food delivery, groceries, flights, hotels, restaurant reservations, fitness classes and event tickets. - How your agent uses it:
Tool, one buy tool your agent calls. The CLI shows a short example of the code above the question.APIis coming soon. - Which wallet pays:
Agentcard Vault. Your users save their card once and approve each purchase with their passkey. More wallets are coming soon.
Install the SDK
The CLI asks before it installs, with yes as the answer when you press Enter:pnpm add with pnpm-lock.yaml, yarn add with yarn.lock, bun add with bun.lock or bun.lockb, and npm install otherwise. In a monorepo package it reads the workspace root’s lockfile. A folder with no package.json installs nothing, and the CLI tells you to run init from your app’s folder. --skip-install sets everything up without installing.
Let Agentcard’s agent build it in
After the install, the CLI asks once more:- You need to be signed in. If you are not, the CLI offers to sign you in right there and then carries on.
- If your git repository has uncommitted changes, the CLI says so and asks whether to go on, with no as the answer when you press Enter. Commit or stash first, so the agent’s changes are easy to review and undo.
- The CLI puts your company’s sandbox client ID and secret in your app’s env file:
.env.localfor Next.js,.envotherwise. It adds that file to.gitignoreso the secret is never committed. An env file that already hasAGENTCARD_CLIENT_IDis kept as it is, and an env file that git already tracks is left alone.
111111.
Know what the agent can touch
The agent works in your project folder: it reads, edits and searches files there, and runs commands such as installs, typechecks and tests. The CLI refuses file-tool requests for paths outside the folder and env files other than.env.example. The CLI also refuses commands that print an env file or the environment. Your app reads the credentials from the environment, so the agent never needs their values.
The CLI checks the agent’s requests, but does not sandbox its commands. The agent’s commands run as you, with your permissions, so a command or a script the agent writes and runs can reach files outside the folder. Commit your work before you start, and review every change with git diff.
A run stops after 30 minutes, or sooner when it reaches its limit for one run. Your account also has a daily limit for the agent. When you reach it, the CLI says so, and the limit resets within 24 hours:
Use your own coding agent
--print skips Agentcard’s agent and prints the instructions for your own, such as Claude Code, Cursor or Codex:
agent-cards guide commerce-sdk prints:
Run it without a terminal
A coding agent or a CI job answers every question with a flag:init installs the SDK and prints the instructions on stdout, the same as --print. Its other notes go to stderr, so > file captures the instructions alone. A missing flag stops it before anything runs:
--implementation api is refused until the API arrives:
--yes says yes to the install and to Agentcard’s agent. The question about uncommitted changes is still asked.