# Read this first (agents)

> Facts and rules for an AI model working with DashForDevs.

Source: https://docs.dashfordevs.com/v1/ai-agents/read-this-first · Topic: For AI agents · Updated: 2026-11-07

This page is written for AI models and the people who configure them. It is short on purpose.

## Facts

-   **Public API base:** `https://papi.dashfordevs.com`. Storefront reads are under `/api/storefront/...`; admin writes under `/api/storefront/admin/...` (secret key only).
-   **Auth:** header `X-API-Key: <key>`. `pk_` keys are read-only; `sk_` keys can write. One key belongs to one organization and can never reach another.
-   **MCP server:** `https://papi.dashfordevs.com/mcp/org` with `Authorization: Bearer sk_...`. See [Connect an assistant](https://docs.dashfordevs.com/v1/ai-agents/connect-an-assistant).
-   **Errors:** JSON `{"error": "<code>", "message": "..."}`. Branch on `error`. `501 not_implemented` and `503 not_available_yet` (with `"available": false`) are final: do not retry.
-   **Rate limits:** 120 requests per minute for a public key, 300 for a secret key. On `429`, wait `retry_after` seconds.
-   **Docs as text:** every page here has a Markdown copy at the same address plus `.md`. [/llms.txt](https://docs.dashfordevs.com/llms.txt) indexes all pages; [/llms-full.txt](https://docs.dashfordevs.com/llms-full.txt) is everything in one file.

## Rules

1.  **Never put a secret key where a browser, a user or a log can read it.** Not in client code, not in a `NEXT_PUBLIC_` variable, not in a reply to the user, not in a commit.
2.  **Never write personal data into public content.** Blog posts, page groups and media are public. Customer names, emails, health details and order contents must never go there.
3.  **Draft first.** Create blog posts and page items as drafts unless the person explicitly asked you to publish.
4.  **Ask before deleting.** Deletions through the admin API are real and immediate.
5.  **Do not retry writes blindly.** A write that timed out may have succeeded; read before writing again.
6.  **Stay inside the organization you were given.** Do not ask for, guess or use other organizations' keys.
7.  **Respect the gates.** If a route answers `not_available_yet` because of the personal-data gate, tell the person; do not look for a way around it.
8.  **No em dashes in content you write for a DashForDevs organization's site**, unless the person asks for them.