Site HTTP APIs

The NextBento marketing site publishes a small set of HTTP APIs for checkout, health, and IndexNow. Agents can discover them from a single catalog instead of scraping HTML.

The product repo has a larger authenticated API surface (auth, billing, teams, keys). That surface is not hosted on this domain.

Discovery

curl -sI https://www.nextbento.dev/.well-known/api-catalog
curl -s https://www.nextbento.dev/.well-known/api-catalog
curl -s https://www.nextbento.dev/openapi.json

Each catalog entry uses:

• anchor — the API URL
• service-desc — OpenAPI document
• service-doc — this page
• status — /api/health

The homepage also sends RFC 8288 Link headers (api-catalog, service-desc, service-doc, describedby) so agents do not have to guess these paths.

curl -sI https://www.nextbento.dev/ | grep -i '^link:'

MCP — /.well-known/mcp/server-card.json

This origin publishes an MCP Server Card so agents can discover a public Streamable HTTP server before connecting.

curl -s https://www.nextbento.dev/.well-known/mcp/server-card.json

The card includes serverInfo (name, version), transport.endpoint (/mcp), and capabilities for tools and resources. Tools return marketing facts and docs. This server does not authenticate users or create accounts. Humans still purchase via GET /api/checkout.

Checkout — GET /api/checkout

Starts a Stripe Checkout session for the $59 NextBento license and redirects to Stripe. The buyer must supply a GitHub username in Checkout so repo access can be granted after payment.

Not a JSON API: browsers follow the 302. If Stripe is not configured, the origin returns 500 with { "error": "..." }.

Health — GET /api/health

Returns { "status": "healthy", "timestamp": "<ISO-8601>" } when the origin can serve requests. It does not probe Stripe, Resend, or GitHub.

IndexNow — POST /api/indexnow

Submits HTTPS URLs on nextbento.dev / www.nextbento.dev to the IndexNow protocol. Requires header x-indexnow-key matching the origin INDEXNOW_KEY. Do not call this from untrusted clients.

See SEO for the submit script.

Not in the catalog

These exist on the origin but are not third-party APIs:

• POST /api/webhooks/stripe — Stripe → origin only; verify signatures
• GET /api/eventdash-stats — internal live-visitor widget

Related

• API routes in the product repo
• AI Search Discoverability
• RFC 9727
• SEP-1649 MCP Server Cards