SKILL.md file, loaded progressively. Only the name and description sit in the agent’s
context at rest; the body loads when a task actually mentions Taberna, and the reference
files load only when a task needs that depth. Installing it costs you roughly a sentence
of context until the moment it is useful.
What it teaches an agent
Start by discovering the key's scopes
Start by discovering the key's scopes
Call
GET /v1/store at boot and assert the scopes you need, rather than probing an
endpoint and catching the 403. The skill makes this step zero of every
integration, and teaches the 401-versus-403 distinction so an agent never
writes a retry loop around a missing scope.The order and invoice flows, with real payloads
The order and invoice flows, with real payloads
When to reach for a catalogue order versus a composed invoice, the exact request
bodies, what the
201 actually returns, and the rule that you redirect to the
checkoutUrl Taberna gave you rather than building the URL yourself.Webhook verification over the raw body
Webhook verification over the raw body
The
HMAC_SHA256(secret, "{timestamp}.{rawBody}") scheme, a complete Node verifier,
the framework-specific hooks for getting raw bytes, constant-time comparison, and
the five-minute timestamp tolerance you have to enforce yourself. This is the
single most common integration bug and the skill leads with it.Idempotency that survives a resend
Idempotency that survives a resend
That a manual resend reuses the same
X-Taberna-Delivery-Id and buys exactly
one more attempt — so deduplicating on the delivery id silently drops the replays a
merchant is sending precisely because something went wrong. The guard belongs in
your own business state.The sharp edges
The sharp edges
That there is no test mode and no refund endpoint, that every schema violation
returns the same opaque
{"error":"Invalid request data"}, that a malformed short
id is a 400 and not a 404, that fiat is a decimal string and crypto is a
smallest-unit integer string, and that there is one webhook URL per store with no
event filtering.What does not exist
What does not exist
An agent’s most expensive habit is fabricating a plausible endpoint. The skill lists
the complete
/v1 surface and names the things people invent: a sandbox mode, a
tbrn_test_ prefix, refunds, API routes for creating products or keys, a second
webhook URL, subscriptions, a storeId parameter.Install
- Any agent (recommended)
- Claude Code
- Other clients
The skills CLI reads this site’s discovery index, shows
you what is available, and installs it into whichever agents it finds:This is the only method that updates cleanly — re-run it to pick up a new version.
The raw file lives at
/.well-known/agent-skills/taberna/SKILL.md,
and the discovery index listing it is at
/.well-known/agent-skills/index.json.
Point any tool that understands the standard at https://docs.taberna.io and it will
find them.What you get
SKILL.md is self-contained — an agent that has only that file can still build a correct
integration. The reference files exist so the common path stays short: they are pulled in
only when a task needs that level of detail. The full bundle, including references, is in
the docs repository.