# StablecoinX Business

> Merchant dashboard for StablecoinX. Onboard a business, create and manage stablecoin payment sessions, mint and revoke API keys, configure webhooks, and manage paymaster clients (publishable `pmc_*` client IDs) with their origin/chain allowlists and sponsored-gas usage. Merchant access is thirdweb-authenticated.

Every operation in this dashboard is also available headlessly through the official StablecoinX MCP server at https://github.com/e2xlabs/stablecoinx-mcp (npm: https://www.npmjs.com/package/@stablecoinx/mcp) — the agent-facing equivalent of this UI. Install with `npx @stablecoinx/mcp setup`.

## Surface

- [Merchant dashboard](https://business.harness.stablecoinx.com/): onboarding, payment sessions (`/sessions`, `/sessions/new`, `/sessions/:id`), settings (`/settings/profile`, `/settings/api-keys`, `/settings/webhooks`), and paymaster (`/paymaster/clients`, `/paymaster/allowlist`, `/paymaster/activity`).

## Backend

- **Merchant API** — `https://api.harness.stablecoinx.com`: merchant profile, payment sessions, API keys, webhooks, and paymaster-client management. Access is thirdweb-authenticated (email-OTP → JWT) or via `sk_*` API keys for server-to-server. There is no public OpenAPI spec for the merchant API; the supported machine interface is the StablecoinX MCP server above.
- **Managed paymaster RPC** — `https://api.harness.stablecoinx.com/v1/paymaster/rpc`: requires a publishable `pmc_live_*` / `pmc_test_*` clientId (created here) sent via the `X-Client-Id` header, with per-client origin + chain allowlists enforced before the call reaches the paymaster. See the [paymaster-ui llms.txt](https://paymaster-ui.harness.stablecoinx.com/llms.txt).

## Networks

The harness serves a sandbox testnet mode and live mainnet settlement, resolved server-side per the merchant account.

## Privacy

- Merchant data is access-controlled (thirdweb auth / `sk_*` API keys). Non-custodial: settlement happens on-chain via the user's smart account; the dashboard never holds funds.

## Security

- Vulnerability disclosure: `tech@e2xlabs.com`. Machine-readable contact at [/.well-known/security.txt](https://business.harness.stablecoinx.com/.well-known/security.txt) (RFC 9116).
- See [llms-full.txt](https://business.harness.stablecoinx.com/llms-full.txt) for the extended install + tool reference for the MCP server.