# Docs - User Guide - **Get started** - [What is Varis](/): Learn how Varis lets you earn from your APIs and lets your AI agents pay for the services they use. - [Quickstart: publish a service](/quickstart/publish): Put your API on Varis in under three minutes, from the dashboard or the CLI. - [Quickstart: connect an agent](/quickstart/agent): Connect your AI assistant or your own agent to Varis and call your first paid service in under three minutes. - [Core Concepts](/concepts): Learn the terms used throughout the Varis docs, from owners and services to holds, earnings, and payouts. - **Publish services** - [Overview](/publish): Choose how to publish your services to Varis, from the dashboard or with the CLI. - [Publish a service](/publish/create): Publish a service from the dashboard or with the CLI, and learn what every field does. - [Update a service](/publish/update): Change a published service's details, price, schemas, or endpoint, and disable or re-enable it. - [Handle requests](/publish/handle-requests): Learn what Varis sends to your endpoint, how to verify it, and what your endpoint must return to get paid. - **Use services** - [Top up your balance](/use/topup): Add money to your Varis balance from the dashboard, redeem a coupon, or let your agent send you a funding link when the balance runs low. - [Connect an AI assistant](/use/connect-an-assistant): Connect Claude, ChatGPT, Cursor, or another MCP client to Varis so that it can find and pay for services. - [Headless agents](/use/agent-keys): Create an agent key for a script, backend service, or your own agent, and use it to call services through the Varis API or MCP server. - [Spend limits](/use/spend-limits): Control how much each agent can spend per call and per day, and which kinds of services it can call. - [Discover and invoke services](/use/invoke): Search Varis for services, call them through the HTTP API, retry safely, and handle every error. - [Transactions](/use/transactions): See every top-up, service call, earning, and refund on your account, and trace each one back to the call that caused it. - **Earnings and payouts** - [How earnings work](/earnings): Learn when you earn from your services, how much you keep, and where to track it. - [Fees and refunds](/earnings/fees-and-refunds): Understand the Varis fee on calls, the payout fee, and how refunds work for failed and reversed calls. - [Payouts](/earnings/payouts): Set up a payout account with Stripe, and learn when and how Varis pays your earnings to your bank. - **CLI** - [Install the CLI](/cli/install): Install the Varis CLI on macOS, Linux, or Windows, and keep it up to date. - [varis login and varis logout](/cli/login): Sign your machine in to Varis so that the CLI can publish for you. - [varis init](/cli/init): Connect a project to a Varis owner, set its addresses, and point coding agents to the SDK docs. - [varis build](/cli/build): Generate the services in varis.json from the define calls in your code. - [varis publish](/cli/publish): Publish the services in your project to Varis with one command. - [varis.json reference](/cli/varis-json): Every field in varis.json, the file that describes your project's services to Varis. - [Local development](/cli/local-development): Test your service on your own machine with varis test, and fix any issues before you publish it. - [Uninstall](/cli/uninstall): Remove the Varis CLI from your machine with varis dracarys. - **SDKs** - [TypeScript](/sdks/typescript): Declare Varis services and verify Varis requests in TypeScript and JavaScript with @usevaris/sdk. - [Other languages](/sdks/other-languages): Publish and verify Varis services in any language, without an SDK. - API Reference - [Overview](/reference): Every endpoint of the Varis API, with the credential each one takes. - [Collect a CLI sign-in's token](/reference/exchangeDeviceCode): Poll this with the device code from `/v1/cli/device/code` every `interval` seconds. Until the developer decides, it answers `authorization_pending`. Once they approve, it returns a device token, exactly once. Answers in OAuth's own shape (RFC 6749 section 5, RFC 8628 section 3.5), not the Varis error envelope, so any device-flow client reads it. Stop polling on `access_denied`, `expired_token`, or `invalid_grant`. Unauthenticated: the device code is the credential. - [Get a service](/reference/getService): Published services are readable by any credential. An agent, or any caller that doesn't own the service, gets it as discovery lists it, with `price_usd`. The service's own owner gets it as they publish it, with `price_cents`, `endpoint_url`, and `method`. - [Invoke a service](/reference/invoke): Validates the input against the service's declared input schema, calls the provider, and validates the response against the declared output schema. A response that violates the output schema is a failure: the provider has not delivered. Requires an agent key. A developer API key is rejected with `403`. - [List the owners you belong to](/reference/listMyOwners): The owners the signed-in developer is a member of, with their role in each. `varis init` shows these as a picker and writes the chosen `id` into `varis.json` as `owner_id`. Needs only the device token. `X-Varis-Owner-Identifier` is ignored, because choosing an owner is what this list is for. - [List signing keys](/reference/listSigningKeys): The public keys that verify the signature on requests Varis sends to your endpoint. Use the key whose `kid` matches the request's `X-Varis-Key-Id` header. Needs no credential. - [Sign this machine out of the CLI](/reference/logout): Revokes the device token that sends the request, and only that one. Other machines signed in as the same developer stay signed in; sign them out from the dashboard's Devices settings. Needs only the device token. Afterwards the token is rejected on every route, this one included, so a second call is a `401`. Treat that as success: the machine is signed out either way. - [Publish a service](/reference/publishService): Creates a service, or updates the existing one with the same `slug` under your ownership. The slug identifies the service permanently. Changing a slug creates a second service rather than renaming the first. Publishing is idempotent. Sending an unchanged definition returns `200` with `unchanged: true` and writes nothing, which is what makes `varis publish` safe to run on every deploy. Requires a signed-in developer who is a member of the owner named in `X-Varis-Owner-Identifier`. The published service is attributed to that person. - [Search published services](/reference/searchServices): Returns published services only. Accepts either credential type. Different parameters are ANDed. Repeated `category` values are ORed. So `?q=weather&category=climate&category=science` means "matches weather, AND is in climate or science". - [Start a CLI sign-in](/reference/startDeviceAuthorisation): Starts `varis login`. Returns a device code for the CLI to poll with, a user code for the developer to enter at `verification_uri`, and how often to poll. The device code is a secret and this is its only copy. Varis stores its hash. The handshake expires after `expires_in` seconds, 10 minutes, whether or not anyone approves it. Unauthenticated, because the developer has no token yet, so limited per IP address. - [Update your own service](/reference/updateService): Partial update. Omitted fields are left unchanged. Requires a signed-in developer who is a member of the owner named in `X-Varis-Owner-Identifier`, and the service must belong to that owner. `slug` is immutable. Publishing under a new slug creates a second service.