jpm-integrations-get-started

JPM Integrations — Get Started

Run a conversational intake for merchants getting started with J.P. Morgan Payments APIs. Follow the steps in order. Use AskUserQuestion for every multiple-choice question.

Disclaimer (show before Step 1)

Before running the intake, show the user this disclaimer verbatim and wait for them to acknowledge before proceeding:

Disclaimer: We do not assume any responsibility for any issues, damages, or losses that may arise from using the code generated or modified by this skill. These skills rely on AI agents to produce code, and all generated code should be carefully reviewed and verified by a qualified engineer before being deployed to a production environment.

Use AskUserQuestion:

• Question: "Do you acknowledge the disclaimer above and want to proceed?"
• Header: "Acknowledge"
• Options:
• "Yes — proceed"
• "No — exit"

If No, exit this skill.

Domain access check (show after the disclaimer, before Step 1)

This skill and the skills it hands off to reach out to a J.P. Morgan host to fetch documentation, so confirm your environment (corporate proxy, firewall, or network policy) isn't blocking it before starting — otherwise the skill fails partway through.

This skill uses the following domain. Please make sure it is not blocked by your network, proxy, or firewall before proceeding: - developer.payments.jpmorgan.com — documentation and reference content

Ask:

• Question: "Before starting, we need to confirm the domain listed above is reachable from this environment. How would you like to proceed?"
• Header: "Domain access"
• Options:
• "Yes — proceed" — I've confirmed that this domain is not blocked; continue with the intake
• "Run a test to check for access" — check the domain now and report whether it is reachable before continuing
• "No — exit" — the domain is blocked; stop so I can get it allowlisted first

Handle the answer:

• Yes — proceed: continue to Step 1.
• No — exit: tell the user to allowlist the domain with their network/security team, then exit this skill.
• Run a test to check for access: send an HTTPS HEAD/GET to https://<domain>/. Any HTTP response — including 401/403/404 — counts as reachable, so continue to Step 1. DNS failures, timeouts, connection refused, and TLS/proxy interception count as blocked; say so, then either offer a fix you know (proxy allowlist entry, NO_PROXY/HTTP_PROXY, or trust-store adjustment) and re-ask so they can re-test, or ask them to allowlist the domain and exit so they can re-run.

Step 1 — Triage intent

Ask:

• Question: "What are you trying to do with J.P. Morgan Payments?"
• Header: "Goal"
• Options:
• "Migrate from another provider" — moving from a non-JPM processor (Stripe, Adyen, etc.)
• "Start a new JPM integration" — greenfield project

Remember the answer as intent.

Step 2 — Onboarded?

Ask:

• Question: "Have you completed JPM onboarding and received your clientId, certificate, and private key?"
• Header: "Onboarded?"
• Options:
• "Yes — I have all three"
• "No — not yet"

If No, go to Step 5. If Yes, go to Step 3.

Step 3 — Set up the .env file

Read templates/env.example (relative to this skill directory) to determine the variable names this integration expects. Then look in the user's current working directory for a .env file and branch based on what you find. Do not ask the user "generate or update?" — the file's presence and contents determine the branch.

3a — .env exists and has every expected variable set

Tell the user (one line): "Your .env already has all expected JPM variables — skipping .env setup." Go to Step 4.

3b — .env exists but is missing one or more expected variables

List the missing variable names to the user (names only — never echo values from the existing file), then ask:

• Question: "I'll append the missing variables to your existing .env with placeholder values. Proceed?"
• Header: "Update .env?"
• Options:
• "Yes — add them"
• "No — I'll handle it"

If Yes:

1. Append each missing variable (with a placeholder value) to the bottom of .env. Do not overwrite values the user has already set.
2. Read .gitignore in the project root. If a line equal to .env is not present, append .env to it. If .gitignore doesn't exist, create one containing .env.
3. Confirm to the user which variables were added (by name only) and remind them to fill in any placeholders before running downstream skills.

Go to Step 4 either way.

3c — No .env found

Ask:

• Question: "No .env found in the project. Generate a sample one from the skill template?"
• Header: ".env setup"
• Options:
• "Yes — generate sample"
• "No — I'll create it myself"

If Yes:

1. Copy templates/env.example to .env.example in the user's current working directory.
2. Read .gitignore in the project root. If a line equal to .env is not present, append .env to it. If .gitignore doesn't exist, create one containing .env.
3. Tell the user: "Created .env.example in your project root and ensured .env is gitignored. Copy .env.example to .env, fill in the values, and do not commit .env. Downstream skills will read these at runtime."

Go to Step 4 either way.

Step 4 — Implement auth?

This step runs after the .env has been generated or updated. The user has confirmed possession (or imminent possession via .env) of clientId + cert + key. Credential validation happens downstream when jpm-oauth (or the next skill that needs them) actually loads the .env.

Ask:

• Question: "Would you like me to implement the JPM OAuth flow now?"
• Header: "Implement auth?"
• Options:
• "Yes — generate auth code"
• "No — I'll do it later"

If No: exit.

If Yes:

1. Detect language and libraries. Look in the user's current working directory for a dependency manifest. Check in this order and stop at the first match:

• package.json → JavaScript / TypeScript
• requirements.txt, pyproject.toml, Pipfile, setup.py → Python
• pom.xml → Java (Maven)
• build.gradle, build.gradle.kts → Java / Kotlin (Gradle)
• go.mod → Go
• Cargo.toml → Rust
• Gemfile → Ruby
• composer.json → PHP
• *.csproj, *.fsproj → .NET

If a manifest is found, scan its dependencies for any HTTP client (axios, node-fetch, got, undici, requests, httpx, okhttp, reqwest, etc.) and any JWT/crypto library (jsonwebtoken, jose, pyjwt, jjwt, golang-jwt, etc.) the project already uses. The point of this scan is to reuse what's already there rather than introduce new dependencies.

1. Decide whether to ask the user. The principle: only ask for what you couldn't infer.

• If language is detected and at least one HTTP client and a JWT library are already present in the manifest, do not ask — just announce: "Detected <language> with <http-lib> and <jwt-lib> — the auth implementation will use those."
• Otherwise prompt the user (free text) for the gaps only:
• Programming language (if not detected)
• Preferred HTTP client (if none in manifest) — user can answer "any"
• Preferred JWT library (if none in manifest) — user can answer "any"

1. Hand off to `jpm-oauth`. Invoke the jpm-oauth skill via the Skill tool. The OAuth skill picks up the conversation context — credentials location, SHA-1 thumbprint, integration intent from Step 1, and target stack (language + HTTP client + JWT library) — and only asks the user for what it doesn't already know (target environment CAT/PROD, JWT TTL, and output location for the generated code). The resource_id is read from JPM_RESOURCE_ID in the .env at runtime — the user fills it in using the comment already in .env.example, no question is asked. Exit this skill once jpm-oauth takes over.

Step 5 — Not yet onboarded

Tell the user:

JPM onboarding is handled by your Relationship Manager (RM). Please reach out to your RM to begin onboarding and to receive your clientId, certificate, and private key. Once you have them, run this skill again.

Then exit.

Rules

• Never write clientId, cert contents, or private key contents to any persistent file under your control. The only files this skill creates or modifies are .env.example (placeholders only), the user's .env (only to append missing variable names with placeholder values — never overwriting existing values), and .gitignore (to ensure .env is ignored).
• Always mask the clientId when echoing it back (last 4 chars only).
• Never echo or log the contents of the private key, nor any value already set in the user's .env.