AI coding assistants
Point Cursor, Claude Code or Copilot at llms.txt and a ready prompt so they write the integration for you.
Assistants write better integrations with the real API in front of them. We publish two plain-text files for that:
| File | What's in it | Use it when |
|---|---|---|
| /llms.txt | A short index of the docs and a compact API summary | The assistant can follow links, or you want a small context |
| /llms-full.txt | The full API contract, webhook verification, price-UI rules and errors in one file | You want the assistant to work offline from one document |
Both follow the llms.txt convention.
Add the docs to your assistant
- Cursor: open Settings, then Indexing & Docs, add
https://2fa.mn/llms-full.txtas a doc, and mention it with@in chat. - Claude Code: paste the prompt below, or ask it to fetch
https://2fa.mn/llms-full.txt. You can also save the file in your repo and reference it fromCLAUDE.md. - GitHub Copilot: add the file to your repo (for example
docs/2fa.md) and reference it from.github/copilot-instructions.md. - Any chat assistant: paste the contents of
llms-full.txtinto the conversation.
Ready-made prompt
Copy this into your assistant and adjust the stack:
Integrate 2fa.mn phone verification into this project.
Read the API spec at https://2fa.mn/llms-full.txt first and follow it exactly.
Requirements:
- Store TWOFA_KEY (sk_test_... for now) and TWOFA_WEBHOOK_SECRET in environment variables. Never expose them to the browser.
- Backend: add POST /api/2fa/session (creates a session via POST https://api.2fa.mn/v1/sessions with metadata.user_id) and GET /api/2fa/session/:id (proxies GET /v1/sessions/{id}, returns only id, code, short_code, sms_uri, status, expires_at).
- Webhook: add POST /webhooks/2fa. Verify X-2FA-Signature (t=...,v1=...) as HMAC-SHA256 of "<t>.<raw body>" with a constant-time compare, reject if |now - t| > 300 s, deduplicate on event id, respond 2xx within 10 s. On verification.succeeded, mark data.phone as verified for data.metadata.user_id.
- Frontend: show "150₮" before a "SMS илгээх" button that links to sms_uri. Also show the code and 150073 as text. Poll our backend every 2 s; hide the button when status is verified or expired.
- Add a test script that calls POST https://api.2fa.mn/v1/test/mo with the session code to simulate the user's SMS.Tips
- Ask the assistant to show you the signature check. It's the part most often gotten wrong: it must use the raw body, not re-serialized JSON.
- Make sure the price notice and the hide-after-verified behavior survive refactors. They're required by the terms; see Price-before-sending UI.
- Start with test API keys and test mode. Switching to live only changes the API key.
What's next
Was this page helpful?