setup-chip

# CHIP Collect API Use this skill for CHIP Collect payment integration work. ## Source Read `references/chip-collect-docs.md` before giving factual API guidance or writing integration code. It contains all downloaded CHIP Collect markdown pages plus embedded OpenAPI blocks from: `https://docs.chip-in.asia/chip-collect/overview/introduction` Read `references/account-setup.md` when user asks how to register, which API keys are needed, where credentials come from, or what dashboard setup is required. ## Core Facts - Base URL: `https://gate.chip-in.asia/api/v1/` - Auth: `Authorization: Bearer <secret key>` for every request. - Credentials: API key and Brand ID come from CHIP Collect Developers pages in portal. - Amounts: money values are smallest currency units. Example: `price: 100` equals `RM 1.00`. - Create checkout/payment link flow: `POST /purchases/`, then use response `checkout_url`. - Payment status options: success callback, `GET /purchases/{id}/`, or webhook events. - Test cards: `4444 3333 2222 1111` non-3DS, `5555 5555 5555 4444` 3DS, CVC `123`, expiry >= current month/year. - Callback signature: `X-Signature` is base64 RSA PKCS#1 v1.5 over SHA256 digest of raw request body. - Success callback public key: `GET /public_key/`; webhook public key: `Webhook.public_key`. ## Lookup Map - Purchases: create, retrieve, cancel, capture, charge token, refund, release, resend invoice, mark paid. - Clients: create/list/retrieve/update/delete, recurring token list/retrieve/delete. - Webhooks: create/list/retrieve/update/delete. - Payment methods: `GET /payment_methods/`, usually with `brand_id` and `currency`. - Direct post: intro, card, FPX, DuitNow QR, e-wallet. - Online flows: payment link, pre-authorization, subscriptions, custom flow. - Account/reporting: balance, turnover, company statements. ## Working Rules - Use exact endpoint paths and request fields from reference OpenAPI blocks. - Preserve trailing slashes on CHIP Collect endpoints as documented. - For code, keep secrets in env vars and never hard-code API keys or Brand IDs. - For webhooks/callbacks, require raw request body for signature verification. - If user asks for latest pricing, legal terms, supported methods, or production portal state, verify live docs first.