# Build a MeshHub shop with an AI app builder

Paste the prompt below into an AI app builder (Replit Agent, or any
agent that can fetch URLs and run Node). It produces a small working
shop on the MeshHub tenant API. Swap the vertical in the first line for
what you're selling: hair salon appointments, car rentals, flights,
parcel shipping, or hotel rooms.

---

```text
Build me a simple hair-salon booking web app (Node backend + minimal
HTML/JS frontend) integrated with the MeshHub tenant API.

Integration docs — fetch this first and follow it:
https://merchant.meshhub.ai/llms.txt

Requirements:

1. Authentication & key safety. Mint ONE trial API key
   (POST https://merchant.meshhub.ai/api/v1/auth/trial-keys/ — no auth,
   no body) and store the returned key in the MESHHUB_API_KEY secret
   (Replit: Secrets tool). Never hardcode it, never send it to the
   browser, and never mint again while the stored key works — minting
   is capped at 3/hour per IP and the key lasts 7 days. If minting
   returns 429, another app on this IP used the budget: honor the
   Retry-After header instead of retrying in a loop.

2. Architecture: thin frontend. The browser calls only YOUR backend
   (/api/*); your backend calls MeshHub with the X-MH-Key header. A
   reference implementation of this exact pattern is at
   https://merchant.meshhub.ai/docs/examples/thin-frontend.md

3. The flow to implement: search -> show offers -> booking form ->
   book -> pay -> order list -> profile page.
   - Search is async: POST /api/v1/search/ returns 202 with a task_id;
     poll GET /api/v1/tasks/<id>/ immediately, then with backoff.
     Offers are in result.offers (an object, not a bare array) and
     result.field_schema lists exactly which booking fields to collect
     — render the form from it dynamically. Its full spec (entry
     shape, dotted-key namespacing, format values, arrays) is in §6.2
     of the integration guide.
   - Prices: show offer.price with offer.currency (the offer's
     currency is authoritative). Pass offer.price through as
     quoted_price when booking.
   - If an offer's booking_mode is "enquiry", a successful booking is
     "request sent" (order stays pending until the supplier confirms),
     not "booked".

4. MeshHub is the system of record — do NOT create local orders or
   customers tables. Key every customer by your app's own user id:
   pass it as end_user_external_id when booking, render the order
   list from GET /api/v1/orders/?customer=<that-id>, and render the
   profile page from GET /api/v1/end-users/?external_id=<that-id>
   (save edits with PATCH; free-form extras go in extra_info). Your
   own database stores login credentials and sessions only.

5. Budget your requests. Trial keys are limited to 10 requests/minute
   and task polls count toward it. Keep discovery calls minimal and
   back off hard on any 429.

6. Verify with a REAL search against the live API before building the
   UI (the trial tenant has live demo inventory; if a search returns
   zero offers, retry with an empty filter to see what exists). Do NOT
   place a real booking while developing — trial keys execute against
   live suppliers. Wire the /book/ call but gate it behind an explicit
   confirmation step enforced SERVER-SIDE (your backend refuses to call
   MeshHub without a confirm flag), not just a frontend dialog.

7. Prefer the official SDK: npm install @meshhub/sdk (typed client,
   task polling and error mapping built in — it works against the API
   as-is, including through the CDN). If you hand-roll HTTP instead,
   send a normal browser-like User-Agent header from your backend —
   default library user agents can be challenged by the CDN.
```

---

## Notes for humans

- The prompt works with any builder that can read URLs; it is tuned so
  the agent self-serves a key and avoids the common traps (key reuse,
  poll budgets, `result.offers`, enquiry mode).
- **Key safety is the non-negotiable part**: the MeshHub key belongs in
  a server-side secret. If your builder generates frontend code that
  sets `X-MH-Key`, tell it to move the call behind its own backend
  route.
- When you outgrow the trial key (7 days, 10 req/min, shared demo
  inventory), contact MeshHub for a production tenant and swap the
  secret — no code change needed.
- Want the pieces instead? [Quickstart (curl)](tenant-integration.md)
  §12 · [Postman collection](meshhub.postman_collection.json) ·
  [thin-frontend reference example](examples/thin-frontend.md) ·
  [TypeScript SDK](sdk-typescript.md).