# Zoral — Developers

> Scoped context for Zoral's developer and agent surface. This is the API
> section only. For the whole site, see https://getzoral.com/llms.txt

## When to use this

- You want product data, live prices, stock, or reviews for Zoral's tongue scraper.
- You want to build a cart and hand a human a payable checkout link.
- You want to call Zoral as a tool from an AI agent.

No API key, no sign-up, and no sales call is required for any of that.

## Quickstart

Read the catalog (zero auth):

```
curl "https://getzoral.com/api/store/products"
```

Create a payable checkout session (zero auth):

```
curl -X POST "https://getzoral.com/checkout_sessions" \
  -H "Content-Type: application/json" \
  -H "API-Version: 2026-07-16" \
  -d '{ "items": [{ "id": "tongue-scraper", "quantity": 1 }] }'
```

Read `totals.total.amount`, then send the buyer to
`payment_provider.checkout_url`. Zoral never accepts card details from an agent.

## Documentation
- [Developer portal](https://getzoral.com/developers): quickstart, credentials, endpoints, errors.
- [Developer portal as markdown](https://getzoral.com/developers.md)
- [OpenAPI 3.1](https://getzoral.com/openapi.json): machine-readable, function-calling ready.
- [auth.md](https://getzoral.com/auth.md): OAuth 2.0 walkthrough for agents.
- [Pricing](https://getzoral.com/pricing.md): machine-readable pricing.

## Credentials (optional)
Registration is open and self-service (RFC 7591) — there is no approval step:

```
curl -X POST "https://api.getzoral.com/oauth/register" \
  -H "Content-Type: application/json" \
  -d '{ "client_name": "Your App", "scope": "catalog:read cart:write" }'
```

Then exchange for a 1-hour token with the `client_credentials` grant at
https://api.getzoral.com/oauth/token. Scopes: `catalog:read`, `cart:write`.
Revoke at https://api.getzoral.com/oauth/revoke (RFC 7009).

Discovery:
- https://api.getzoral.com/.well-known/oauth-authorization-server (RFC 8414)
- https://api.getzoral.com/.well-known/oauth-protected-resource (RFC 9728)

## MCP
- https://getzoral.com/mcp — store surface: search_catalog, get_product, get_reviews, get_shop_policies
- https://getzoral.com/mcp/docs — content surface: search_articles, get_article, list_article_tags, search_faqs

Both are zero-auth Streamable HTTP, protocol 2025-06-18. The store surface has
no place_order, add_payment or set_customer tool; that absence is the isolation
guarantee.

## Testing
There is no separate sandbox host and none is needed. Reads are side-effect
free. Checkout sessions are ordinary carts: creating one, adding items and
applying the 10OFF code charges nothing and reserves nothing. A session only
becomes an order once a human pays on Stripe.

## Skills
- https://getzoral.com/.well-known/agent-skills/index.json (sha256-digested)
- https://github.com/getzoral/agent-resources

## Contact
hello@getzoral.com