Model

Configuration reference

Every option on withPaywall, paidTool, the Moove provider and the stores.

withPaywall(server, config)

option	type	default	what it does
`provider`	`PaymentProvider`	required	Opens charges, settles them, issues handles.
`store`	`EntitlementStore`	required	Where credits are spent from. Passed explicitly, never reached for.
`argumentName`	string	`tollboothToken`	The tool argument the agent carries the handle back in.
`copyId`	string	`v3`	Challenge copy variant. All five are measured; v3 ships.
`allow`	string[]	none	Renderer ids permitted beyond the default. Deny-by-default otherwise.
`onSettlement`	fn(outcome)	—	Every settlement observation. Log underpaid loudly.
`onCall`	fn(event)	—	Every paid call, with a handle fingerprint — never the handle.
`now`	() ⇒ number	`Date.now`	Injected clock. Must agree with the provider's.

server.paidTool(name, description, pricing, inputSchema, annotations, handler)

Argument order mirrors Cloudflare Agents’ paidTool. pricing is a sku string or { sku, cost }; cost defaults to 1 and must be a positive integer. The sku must already be sold by the provider, or registration throws. The handler receives the arguments with the handle stripped, and extra.tollbooth set to { subject, sku, cost } so a server can rate-limit per handle.

new MooveProvider(options)

all options

new MooveProvider({
  client, store, prices,
  chargeTtlMs: 60 * 60 * 1000,          // default; floor 15 minutes
  settlementPolicy: {
    toleranceFraction: 0.005,           // within 0.5%: grant in full
    minimumFraction: 0.1,               // below 10%: grant nothing
  },
  subjectTtlMs: 30 * 24 * 60 * 60 * 1000, // sliding; floor 1 hour
});

option	default	floor	notes
`chargeTtlMs`	60 min	15 min	How long a checkout stays payable. There is no deactivation endpoint; expiry is the only containment.
`settlementPolicy.toleranceFraction`	0.005	0	Within this shortfall, grant in full. See underpayment.
`settlementPolicy.minimumFraction`	0.1	0	Below this fraction, grant nothing. Must leave room below the tolerance band.
`subjectTtlMs`	30 days	1 hour	Sliding window on a handle. See security.
`prices`	required	—	Everything this server sells.

new MooveClient(options)

option	default	notes
`apiKey`	required	Held here and never leaves: not logged, not attached to errors, not sent on the public read.
`baseUrl`	`https://api.moove.xyz`	The host shown next to your key. Never guess it.
`maxAttempts`	4	Retries for 429 and 5xx only. The 4xx family is never retried.
`keyedLimiter`	2 req/s	Governs authenticated calls, which consume the per-key budget.
`publicLimiter`	8 req/s	Governs the keyless read, which consumes only the per-IP budget.

The limiter defaults are deliberately conservative despite measured headroom; the rate limits page says why.

Stores

store	option	notes
`MemoryEntitlementStore`	`acknowledgeEphemeral`	Required outside tests; the store warns otherwise. Loses paid credits on restart.
`SqliteEntitlementStore`	`path`	File path or :memory:. WAL mode; busyTimeoutMs defaults to 5000.
`PostgresEntitlementStore`	`connectionString`	Use Neon's pooled host. max (5), maxRetries (5), retryBaseMs (250), migrate (true).

Reference server environment

variable	required	notes
`MOOVE_API_KEY`	yes	The server exits without it.
`MOOVE_API_BASE_URL`	no	Only if your key names a different host.
`DATABASE_URL`	no	Postgres when set; SQLite otherwise. /health reports which.
`TOLLBOOTH_DB`	no	SQLite path. Defaults to /data/tollbooth.sqlite in the HTTP entrypoint.
`PORT`	no	8080.
`TOLLBOOTH_LANDING_URL`	no	Advertised by GET /.

Configuration reference

withPaywall(server, config)#

server.paidTool(name, description, pricing, inputSchema, annotations, handler)#

new MooveProvider(options)#

new MooveClient(options)#