You built the app. Here is where each API fits.
You do not need to become a backend expert. Pick the problem you recognize, copy the setup prompt into your coding agent, and verify the result before you ship.
One rule before you start: an API key is a password for your software. Store it in a server-side environment variable—never paste it into public code, a screenshot, or browser JavaScript.
Find accessibility problems after every build
Why would I use this?
Use Shield when you built a website or web app and want a repeatable list of automatically detectable accessibility problems, suggested next steps, and a way to check whether detectable fixes worked.
What does that look like?
A client site launches on Friday. Your coding agent calls Shield in CI, receives image-alt and contrast findings, fixes them, then rescans before the handoff.
What comes back?
A JSON response containing traceable accessibility violations, severity, WCAG references, and usage. Some criteria still require expert human review.
Add 3Stone Shield to this project. Keep the API key in a server-only environment variable named THREE_STONE_SHIELD_KEY. Create a server-side function that POSTs { url } to https://shield-api.3stoneai.com/api/v1/shield/scan with a Bearer token. Never expose the key in browser code. Show the returned findings in a simple developer report, preserve the API's distinction between automated findings and manual review, and never claim the result proves complete WCAG or legal compliance.POST https://shield-api.3stoneai.com/api/v1/shield/scanAuthorization: Bearer sk_shield_...{ "url": "https://your-site.com" }After your agent finishes, ask it to show you where the key is stored, the exact server-side request, its error handling, and a real test result.
Check the deployed app—not just its source code
Why would I use this?
Use Sentinel before handing off an AI-built or Supabase-backed app. It checks narrow exposure patterns such as anonymous database reads and clearly leaked secrets in browser JavaScript.
What does that look like?
Your app works in staging. Before giving it to the client, Sentinel checks whether its public Supabase setup allows reads that Row Level Security should block.
What comes back?
A JSON response containing the read-only checks performed, evidence, findings, and next actions. A clean result is not a general security guarantee.
Add 3Stone Sentinel as a pre-handoff check. Store the key in a server-only environment variable named THREE_STONE_SENTINEL_KEY. Create a server-side function that POSTs { url } to https://shield-api.3stoneai.com/api/v1/sentinel/scan with Bearer authentication. Never expose the key in client JavaScript. Display each finding with its evidence and scope. Describe Sentinel as a narrow read-only exposure check, not a penetration test or complete security audit.POST https://shield-api.3stoneai.com/api/v1/sentinel/scanAuthorization: Bearer sk_sentinel_...{ "url": "https://your-app.com" }After your agent finishes, ask it to show you where the key is stored, the exact server-side request, its error handling, and a real test result.
Make an AI agent ask before the risky part
Why would I use this?
Use Ledger when an AI agent can send messages, change records, deploy code, issue refunds, make purchases, or delete resources. Your code proposes the action to Ledger and waits for the decision before execution.
What does that look like?
An agent wants to delete old cloud resources. It proposes the action, Ledger returns pending_approval, and your workflow stops until a person approves or rejects it.
What comes back?
A JSON action record with an ID and explicit status. Your workflow must honor that status; Ledger does not execute or automatically intercept the action.
Add 3Stone Ledger immediately before this agent's risky tool call. Store the key in a server-only environment variable named THREE_STONE_LEDGER_KEY. POST the agentId, a plain-language description, and riskLevel to https://shield-api.3stoneai.com/api/v1/ledger/actions. If the returned status is pending_approval, stop and do not execute. Add a separate server-side approval function that POSTs decision and decidedBy to /api/v1/ledger/actions/{id}/decide. Execute only after an approved or auto_approved status, then PATCH the action with the execution outcome.POST https://shield-api.3stoneai.com/api/v1/ledger/actionsAuthorization: Bearer sk_ledger_...{ "agentId": "deploy-bot", "description": "Delete unused storage", "riskLevel": "high" }After your agent finishes, ask it to show you where the key is stored, the exact server-side request, its error handling, and a real test result.
Start with the problem, not the product name.
If your page may exclude users, start with Shield. If your deployed app may expose data or secrets, start with Sentinel. If an AI agent can take a risky action, start with Ledger.
Return to the developer hub