SkillSmith API Integration Builder
Wiring up an API is the easy 20%. The 80% that eats weeks is the resilience layer SDK generators skip — and that layer is the product.
What it does
Most API scaffolders only generate the happy path: one function per endpoint that assumes the network never fails, tokens never expire, and webhooks are always genuine. The work that actually costs weeks is the layer underneath — retries, rate-limit handling, idempotency, webhook signature verification, and a mock server so the team can develop offline.
Give it a target API (Stripe, Twilio, Shopify, Slack, or anything with an OpenAPI spec or docs URL) plus your stack, and it produces a complete, shippable integration package — plain-text source you own and can regenerate without limit.
How it works
A 7-phase workflow, each with a hard quality gate before the next:
| Phase | Output |
|---|---|
| 1. Detect & model | Parse the OpenAPI spec / docs into an integration map; confirm scope before writing code |
| 2. Typed client | One thin, typed method per in-scope endpoint; config from env vars |
| 3. Auth layer | The API's real scheme (Bearer / OAuth2 + single-flight refresh / HMAC); keys from env only |
| 4. Resilience layer | Exponential backoff + jitter, rate-limit awareness, timeouts, typed error hierarchy, idempotency keys |
| 5. Webhook handler | Raw-body, constant-time signature verification with replay protection and correct status codes |
| 6. Mock server | Realistic fixtures + fault injection + signed webhook emission, toggled by one env var |
| 7. Integration tests (TDD) | Happy path, 401, 4xx, 429 retry-then-succeed, retry exhaustion, webhook verify pass/fail — all offline |
⭐ Featured example — a generated Stripe integration
Input: "Integrate Stripe (create a one-time PaymentIntent + handle the payment_intent.succeeded webhook) into Node.js + TypeScript + Express."
Output: a stripe-client/ package — typed wrapper, resilience layer, verified webhook handler, a zero-dependency mock, and an offline test matrix. The Skill doesn't just generate it; it proves it — tsc --noEmit clean and vitest 12 / 12 passing, with the webhook verified end to end:
![Generated test suite: tsc clean, vitest 12/12 passing, webhook verified end-to-end]
And this is the actual package it produces — files you own and drop straight into your repo (resilience, typed errors, webhook verification, a mock, and an offline test suite):
![Generated output: the stripe-client package — client, auth, resilience, errors, webhooks, mock server, and offline tests]
Webhook verification is HMAC-SHA256 over "{t}.{raw_body}" (hex), constant-time compared, with stale timestamps (|now - t| > 300s) rejected — verified against Stripe's official conventions, not a guess.
Verified on a real run of this Skill:
tsc --noEmitclean,vitest12/12 passing, and a valid webhook firing[webhook] payment_intent.succeededend to end.
Why it's different
- The value is the resilience layer, not the happy path. openapi-generator, vendor SDK samples, and the now-shuttered Stainless all give you typed calls. Nobody generates the retry / rate-limit / idempotency / webhook-signature / mock / offline-test layer that quietly costs weeks. That layer is the product.
- A built-in, doc-verified auth + webhook convention table for the four highest-traffic APIs: Stripe (HMAC-SHA256 / hex / 400), Slack (
v0:ts:body/ hex / 401), Shopify (HMAC-SHA256 / base64 / 401), Twilio (HMAC-SHA1 / sorted URL+params / base64 / 403). No more cross-referencing four doc sites or stepping on the "verify against parsed JSON" landmine. - Self-owned, offline-capable, CI-ready — no dependence on any hosted generator or paid API; a fixed output layout that drops straight into CI.
- TDD-driven and guardrailed: failing tests are written before the client; resilience is mandatory; no hardcoded secrets; webhooks must be verified; write retries must carry an idempotency key.
Disclaimer / Scope
This Skill generates self-owned integration source you run in your own environment; it does not call your live third-party accounts on your behalf. API conventions and signature schemes evolve — the bundled references are a verified starting point, and you should confirm against the official docs for your target API's current version before going live.
