What PCIFIC is, what you can build with it, and the shortest path from sign up to your first working call.
PCIFIC gives your shop four tools over a REST API (a set of web addresses your server calls, getting JSON back). Your server sends a request with a secret key. PCIFIC does the checking, writing or answering and sends the result back. You build the screens that show it.
Live PixelTrace groups only take photos from the seller's phone camera, in iPhone Safari or Android Chrome, so arrange a person with a phone first. Opening the link on a computer does not use it up. Test keys can upload and confirm with test-photos and test-confirm.
| Kind of business | What you could build | Tools that fit |
|---|---|---|
| Shops and classifieds | A create-a-listing page that fills itself from photos, a check before a listing goes live, and a buyer question box on every listing. | Orbit, Safeguard, Ask PCIFIC |
| Resale and second-hand shops (phones, clothes, handbags) | Listings written in one house style from a seller's photos, with missing details flagged before publishing. Safeguard does not authenticate an item. | Orbit, Safeguard, PixelTrace |
| Car and other dealers | Adverts written from a few photos and notes into your own fields (make, model, mileage), a check that service history and condition are stated, and answers about delivery or finance from your own documents. | Orbit, Safeguard, Ask PCIFIC |
| Rentals and holiday lets | Answers to guests from your house rules and cancellation policy, a check that a host's listing states the facts a guest needs, and host photos taken live in the camera page. | Ask PCIFIC, Safeguard, PixelTrace |
| Insurance claims evidence | A claimant takes the claim photos live on their phone, you get a signed record of the group and a certificate code, and each new photo is checked against photos already used in your own claims. A match is a cue for a person to review, never proof of fraud. | PixelTrace |
| Property portals and trade-in desks | Listings or trade-in offers written from photos and notes in your own fields, with missing facts raised before they go live. | Orbit, Safeguard |
Your account is your business: its team, its API keys and one credit balance. Each shop inside it has its own settings, listing fields, documents, usage and spending limits. Your business starts with one shop and every call goes to it. Add a shop with POST /api/v1/marketplaces or Add new shop in the Your account menu, then send ?marketplaceId=<id> on every call, from GET /api/v1/marketplaces. With more than one shop, a call that names none is refused with 400 MARKETPLACE_ID_REQUIRED. On the overview, Needs attention starts with Live only traffic; choose All requests or Test only to change which failed requests and warnings appear. Your choice is saved in this browser.
You can make a key on the API keys page and copy the test key into your project's .env by hand. If a coding agent is doing your integration, it uses the plain curl requests below instead. Nothing is downloaded or installed. The first request starts a connection and answers with a code and a link to a setup page in this dashboard. Open the link, type the code (it is never in the page address), review the suggested name, permissions and lifetime, then click Generate. If you did not start this yourself, or someone sent you the page or a code, cancel instead: the key goes to whoever started the connection. Five wrong codes cancel it. The collect request then writes the test key straight into .env as PCIFIC_TEST_KEY without printing it, so your agent never sees the key. A connection lasts 30 minutes until you click Generate, then 60 minutes to collect, and a key that is never collected is cancelled. The live key is never sent to your machine: take it from the API keys page and put it into your production server's settings yourself.
# 1. Start a connection. The answer holds id, confirmationCode and pollToken.
curl -fsS -X POST https://business.pcific.ai/api/key-link \
-H 'content-type: application/json' \
-d '{"suggestedName": "<a short name for this business>", "destination": ".env", "scopes": ["orbit","safeguard","ask-pcific","pixel-trace","settings","listing-fields","read"]}'
# 2. The human opens https://business.pcific.ai/dashboard/link-key?connection=<id>,
# enters the code, checks the key, clicks Generate, then confirms with a password or code if asked.
# 3. Check whether they have clicked Generate. Wait for "status": "ready".
curl -fsS -X POST https://business.pcific.ai/api/key-link \
-H 'content-type: application/json' \
-H 'x-pcific-link-token: <pollToken>' \
-d '{"id": "<id>", "action": "poll"}'
# 4. Collect the test key, once only. It goes straight into .env and is never printed.
# If this fails, stop and tell the human. Never run it a second time. On installation failure, keep the private .pcific-key.*/key response for recovery.
(umask 077 && key_dir=$(mktemp -d .pcific-key.XXXXXX) && curl -fsS -X POST https://business.pcific.ai/api/key-link \
-H 'content-type: application/json' \
-H 'x-pcific-link-token: <pollToken>' \
-d '{"id": "<id>", "action": "collect"}' > "$key_dir/key" && { if [ -f .env ]; then cp -p .env "$key_dir/env"; else : > "$key_dir/env"; fi; } && { grep -v '^PCIFIC_TEST_KEY=' .env 2>/dev/null; cat "$key_dir/key"; } > "$key_dir/env" && mv "$key_dir/env" .env && rm -f "$key_dir/key" && rmdir "$key_dir")
# 5. Prove the key works without showing it. The answer names the key, never its secret.
(PCIFIC_TEST_KEY="$(grep '^PCIFIC_TEST_KEY=' .env | tail -n 1 | cut -d= -f2-)" && curl -fsS https://business.pcific.ai/api/v1/key -H "Authorization: Bearer $PCIFIC_TEST_KEY")The first POST /api/key-link request may include "scopes": ["settings", "listing-fields", "documents", "read"] to ask for setup permissions. Request only the permissions this integration needs. The approval page pre-ticks the requested choices, with labels and explanations; the human can untick anything. Leave scopes out to use the usual defaults. API keys and permissions lists all valid names and explains refusals.
Send the key in the Authorization header, read at runtime from the environment. GET /api/v1/key answers with the key's name, what it may do and the daily cap. It is free, and any key may call it. dailyCap.limit is always a number and dailyCap.usedToday shows today’s count. The count resets at midnight UTC. TEST_DAILY_CAP_REACHED (429) means wait until midnight UTC or use a live key; if you chose a lower cap, you can restore PCIFIC’s ceiling under API keys.
curl https://business.pcific.ai/api/v1/key \
-H "Authorization: Bearer $PCIFIC_TEST_KEY"{
"id": "c2f0f6b0-6b43-4c0e-9d3a-0a1a8f5d2b11",
"name": "Local testing",
"kind": "test",
"prefix": "pcific_test_AbCd",
"can": [
"orbit",
"safeguard",
"ask-pcific",
"pixel-trace",
"read"
],
"expiresAt": "2026-12-18T09:00:00Z",
"dailyCap": {
"limit": 200,
"usedToday": 0
}
}If you got an error instead, find its code on the Errors, limits and retries page. The usual ones for a new key are UNAUTHORIZED (the key was not sent or has a typo) and KEY_EXPIRED.
Every page of this documentation is also served as plain text, with no key and no login. A coding agent doing your integration can fetch the exact page it needs instead of working from a snapshot. The index lists every page and the address that returns it.
curl https://business.pcific.ai/docs.txt
curl https://business.pcific.ai/docs/marketplace-configuration.txtYour integration is a snapshot of the day it was built. The changelog lists every change that affects an integration, newest first, each saying which tools it touches and what you have to do, which is usually nothing. Add a date and it tells you only what is new to you, or that nothing is.
curl "https://business.pcific.ai/changelog.txt?since=2026-08-16"An agent that reads every page fills its context with pages it does not need. This is the order, and what to skip.