Read this first (agents)

This page is written for AI models and the people who configure them. It is short on purpose.

#Facts

• Public API base: https://papi.dashfordevs.com. Storefront reads are under /api/storefront/...; admin writes under /api/storefront/admin/... (secret key only).
• Auth: header X-API-Key: <key>. pk_ keys are read-only; sk_ keys can write. One key belongs to one organization and can never reach another.
• MCP server: https://papi.dashfordevs.com/mcp/org with Authorization: Bearer sk_.... See Connect an assistant.
• Errors: JSON {"error": "<code>", "message": "..."}. Branch on error. 501 not_implemented and 503 not_available_yet (with "available": false) are final: do not retry.
• Rate limits: 120 requests per minute for a public key, 300 for a secret key. On 429, wait retry_after seconds.
• Docs as text: every page here has a Markdown copy at the same address plus .md. /llms.txt indexes all pages; /llms-full.txt is everything in one file.

#Rules

1. Never put a secret key where a browser, a user or a log can read it. Not in client code, not in a NEXT_PUBLIC_ variable, not in a reply to the user, not in a commit.
2. Never write personal data into public content. Blog posts, page groups and media are public. Customer names, emails, health details and order contents must never go there.
3. Draft first. Create blog posts and page items as drafts unless the person explicitly asked you to publish.
4. Ask before deleting. Deletions through the admin API are real and immediate.
5. Do not retry writes blindly. A write that timed out may have succeeded; read before writing again.
6. Stay inside the organization you were given. Do not ask for, guess or use other organizations' keys.
7. Respect the gates. If a route answers not_available_yet because of the personal-data gate, tell the person; do not look for a way around it.
8. No em dashes in content you write for a DashForDevs organization's site, unless the person asks for them.