API Integration Architect Skill
Design secure, reliable API integrations — auth flows, endpoint mapping, request/response structures, error handling, and testing — without inventing endpoints or auth methods.
API Integration Architect Skill is a free, reviewed AI skill for api & integration building. Design secure, reliable API integrations — auth flows, endpoint mapping, request/response structures, error handling, and testing — without inventing endpoints or auth methods. It works with ChatGPT, Claude, Gemini and is ready to use out of the box.
- • Planning a Stripe or payment provider integration
- • Wiring Slack, Discord, or Teams webhook notifications
- • Syncing customer data between a CRM and an app
- • Cannot verify a specific API's current endpoints without the docs — will ask instead of guessing.
- • Does not write production code; it produces integration plans and structures.
- • Cannot test live credentials or hit real APIs.
About this skill
Most AI integration advice invents endpoints, guesses at auth methods, and skips the boring-but-critical parts like retries, rate limits, and webhook verification. This skill acts as an experienced integration architect: it clarifies the business goal, maps only confirmed endpoints, plans authentication against documented methods, and produces a full integration plan covering request/response shapes, error handling, testing, deployment, and maintenance. Every assumption is labeled, and unknowns become open questions instead of fabricated details.
What it does
Produces an API Integration Plan, Authentication Plan, Endpoint Mapping, Request/Response Structures, Error Handling Plan, Testing Checklist, and Deployment Checklist — grounded in confirmed documentation, with assumptions flagged explicitly.
Use cases
- Planning a Stripe or payment provider integration
- Wiring Slack, Discord, or Teams webhook notifications
- Syncing customer data between a CRM and an app
- Designing OAuth flows for third-party platform access
- Adding webhook receivers with signature verification
- Debugging an existing integration's failure modes
- Scoping an integration before writing any code
What is included
- SKILL.md
- workflow.md
- api-integration-framework.md
- integration-checklist.md
- output-templates.md
- examples.md
How to use it
1. Download the ZIP using the Download button. 2. Unzip the api-integration-architect-skill folder. 3. Load SKILL.md into your AI assistant as a skill / system prompt. 4. Describe the systems you want to connect and the integration goal, and share any known API docs.
Examples
We need to integrate Stripe into our app to accept one-time payments.
Goal: Accept one-time card payments in our web app
Systems Involved: Web app ↔ Backend server ↔ Stripe API
Trigger: User submits checkout form
Data Flow Summary: Client requests a payment intent from backend; backend creates it via Stripe API; client confirms payment with returned client_secret using Stripe.js.
Authentication: API key (secret key server-side only, publishable key client-side). Confirmed by Stripe docs.
Credential Storage: Environment variables / secrets manager. Never in source.
Key Endpoints (verify current field names against Stripe docs at implementation time):
- POST /v1/payment_intents — create intent (server-side)
- GET /v1/payment_intents/{id} — retrieve status
- POST {your webhook URL} — receive Stripe events (verify Stripe-Signature header)
Error Handling:
- 401 → re-check secret key, alert
- 400 → surface validation error to user
- 429 → exponential backoff + retry
- 5xx → retry with backoff, then alert
- Timeout → single retry, then fail-safe
Open Questions / Assumptions:
- Assumed web checkout, not mobile SDK — confirm platform.
- Assumed one-time payments only, no subscriptions — confirm.Known limitations
- Cannot verify a specific API's current endpoints without the docs — will ask instead of guessing. - Does not write production code; it produces integration plans and structures. - Cannot test live credentials or hit real APIs. - Rate limit and pricing details must be confirmed against the provider's current documentation.
Quality and safety notes
- ✓ No invented endpoints, parameters, or response fields
- ✓ Authentication method is confirmed against docs or flagged as an assumption
- ✓ Every assumption is explicitly labeled
- ✓ Least-privilege scopes recommended for all credentials
- ✓ Retries, rate limits, and timeouts are addressed, not skipped
- Never suggests hardcoding credentials — always environment variables or a secrets manager.
- Recommends webhook signature verification for any incoming webhook.
- Flags PII and payment data and recommends encryption in transit and at rest.
- Recommends logging that excludes tokens, secrets, and sensitive payment details.