# Skill: public API (no secrets)

Host: https://api.godonate.me

External agents only need user-facing facts. Key names, env, and internal backend paths are not included.

## Safe to know

- Rate and streamer profile come from the API when the donate page opens.
- Payment is created after a network is chosen; address and QR show on `payform.godonate.me`.
- Dashboard actions (payout, widgets, 2FA) need the streamer’s session. Agents must not call them.
- Overlay reads events with a secret token from the dashboard. Do not publish the token.

## Do not

- Invent undocumented endpoints.
- Ask the user for a session cookie, API keys, overlay token, or payout keys.
- Describe webhook secrets or environment variable names.