Introduction
Pallasite AI is an autonomous, enterprise-grade refund governance and policy defense engine built exclusively for modern e-commerce and Shopify merchants. Operating on a Bring Your Own Key (BYOK) architecture, Pallasite deploys a multi-tiered verification pipeline combining deterministic carrier heuristics, customer velocity tracking, and multi-model AI consensus to catch fraudulent claims before payouts leave your store.
Core Architectural Pillars
Sub-5ms Edge Ingestion
Webhook requests are authenticated and enqueued asynchronously in under 5ms, ensuring zero impact on checkout latency or customer response times.
Multi-Model AI Consensus
High-value claims trigger parallel evaluations across OpenAI GPT-6 Astra, Google Gemini 4 Argon, and xAI Grok 4.7, alongside DeepSeek V4 Pro, GLM-5.3 Flash, and Anthropic Claude in our 3-tier consensus triage to eliminate single-model errors and bias.
Merchant Policy Governance
Configure store-specific rules (return windows, category restrictions, weight differentials, restock fees) with custom risk weights and automated overrides.
Direct Wholesale BYOK
Connect your direct Google AI Studio, OpenAI, xAI, OpenRouter, or Anthropic API credentials to run evaluations at raw wholesale utility rates (averaging ~$0.002 per check with 95% policy caching discounts) with 0% Pallasite markup.
Getting Started
Integrating Pallasite AI into your active Shopify store takes less than 2 minutes. Follow this 3-step setup guide:
1 Create Your Merchant Workspace
Register for the Open Beta at our Signup Page. Once registered, Pallasite provisions your isolated workspace tenant, configures secure database isolation, and prepares your Command Center.
2 Generate Merchant API Keys & Configure BYOK
Navigate to Settings ➔ API & Webhooks to retrieve your production API key (formatted with prefix pal_live_...). Enter your Google Gemini (Gemini 4 Argon), OpenAI (GPT-6 Astra), xAI Grok (Grok 4.7), Anthropic Claude, DeepSeek V4 Pro, or GLM-5.3 Flash API keys in the BYOK panel to enable wholesale AI consensus.
3 Connect Shopify Webhooks
In your Shopify Admin, go to Settings ➔ Notifications ➔ Webhooks and paste your dedicated Pallasite webhook endpoint (https://pallasite.online/api/webhooks/shopify) for refunds/create and orders/updated. Pallasite instantly begins monitoring incoming claims in real-time.
3-Step Decision Engine & Consensus Tiers
To deliver maximum precision without introducing delay, Pallasite routes refund evaluations through escalating verification steps: 1. Deterministic rules, then 2. Multi-model AI review, then 3. Merchant sovereign decision:
Fast Screening — Tier 1 (Standard Court) $50–$500
Optimized for low-to-mid value claims ($50–$500). Employs Google Gemini 4 Argon (with 95% context caching discounts on store return policies) paired with promoted citizen GLM-5.3 Flash ($0.15/1M input, 70% confidence threshold), along with deterministic checks: verifying return eligibility windows, item condition, carrier delivery timestamps, and customer return velocities.
Deep Review — Tier 2 (Supreme Court Multi-Model Consensus) Over $500 / Split
High-value (>$500) and disputed claims convene our Supreme Court tribunal featuring Lead Arbitrator OpenAI GPT-6 Astra paired with xAI Grok 4.7 (adversarial exploit defense) and DeepSeek V4 Pro (1.6T MoE independent lineage via OpenRouter). Models independently evaluate carrier weight telemetry, customer claim sentiment, and policy compliance, enforcing a 100% unanimous agreement mandate to eliminate single-model errors and seal chargeback-ready evidence packs.
Merchant Decision — Tier 3 (Merchant Manual Triage Console) Safe Fallback
If consensus nodes disagree or a claim triggers high-risk anomalous signals, automated execution is safely paused and the payout is held in Shopify. The ticket is immediately routed to the merchant's private Triage Queue with structured reasoning dossiers for sovereign one-click human attestation.
Bring Your Own Key (BYOK)
Our BYOK architecture lets you input your own API keys for Google Gemini, OpenAI, OpenRouter, and Anthropic Claude, keeping you in complete control of your inference billing, privacy terms, and data residency.
90%+ Cost Reduction
Pay wholesale token costs directly to your AI provider (~$0.0001–~$0.002 per scan, or ~$1–~$20 per 10,000 scans) instead of opaque SaaS markup bundles.
AES-256 Encryption
Keys are stored securely with AES-256-GCM encryption and decrypted strictly inside ephemeral RAM during active scans.
Revoke Anytime
You retain absolute ownership. Disconnect, rotate, or purge your credentials from settings with one click at any time.
How to Retrieve Your Model Keys (Step-by-Step Walkthrough)
-
1
Google Gemini Key (Gemini 4 Argon · $2.00 / $10.00 per 1M tokens): Visit Google AI Studio, navigate to API Keys, and create a key. Enables Gemini 4 Argon with 95% context caching discounts on your store return policies ($0.10/1M cached input).
-
2
xAI Grok Key (Grok 4.7 · $2.00 / $6.00 per 1M tokens): Generate a key in the xAI Developer Console. Provides sub-400ms adversarial defense against prompt injection, fake receipt fabrication, and serial fraud loops.
-
3
OpenAI Key (GPT-6 Astra · $10/$50 & GPT-6.1 Sol · $2/$10 per 1M tokens): Generate a secret key in the OpenAI Platform Console. Serves as Chief Justice Arbitrator (GPT-6 Astra) in Tier 2 Supreme Court alongside high-efficiency agentic evaluations via GPT-6.1 Sol ($0.10 cached input).
-
4
OpenRouter Key (GLM-5.3 Fast / Flash & DeepSeek V4.1 Flash / V4 Pro): Sign up at OpenRouter.ai and create a key. Powers GLM-5.3 Fast / Flash ($0.15/1M input for routine screening) and DeepSeek V4.1 Flash ($0.27/1M) / V4 Pro ($0.55/1M input; 1.6T MoE for independent CVE and exploit discovery).
-
5
Anthropic Claude Key (Claude Opus 5.5 · $4/$20 & Claude Sonnet 5.5 · $2/$10 per 1M tokens): Generate an API key in the Anthropic Console. Delivers rigorous constitutional reasoning for high-stakes terms and merchant contract disputes, with optional Claude Fable 5.1 and 90% cached prompt read discounts ($0.20/1M).
-
6
Save & Encrypt in Pallasite Vault: In your Pallasite Command Center, open Settings ➔ BYOK Vault. Paste 1 or more keys and click Save BYOK Credentials. Keys are encrypted at rest with tenant-derived AES-256-GCM envelope salting and decrypted strictly in volatile RAM during active scans.
Security & Governance
Pallasite AI is engineered with defense-in-depth architecture: zero-trust tenant isolation, plan-aware rate limiting, multi-factor authentication (MFA) with single-use backup codes, and cryptographic audit trails.
Multi-Tenant Database Isolation Strict Sharding
Every tenant’s scan history, rules, and store credentials are bound to isolated database shards routed dynamically via DatabaseRouter.resolve(tenantId, region). Cross-tenant reads and mutations (IDOR) are structurally rejected at the connection routing layer.
Multi-Factor Authentication (MFA) & Single-Use Backup Codes RFC 6238 TOTP
Merchant administrators can enable RFC 6238 TOTP with Google Authenticator, 1Password, or Authy. Upon enrollment, 10 cryptographically random, single-use 8-character recovery backup codes are issued (stored securely as bcrypt hashes). Consumed backup codes are immediately invalidated to prevent replay attacks.
Plan-Aware Rate Limiting & Concurrency Ceilings DDoS Defense
Public authentication endpoints (e.g. /login, /mfa/challenge) enforce IP-level sliding-window rate limiting to repel brute-force attempts. API scan endpoints dynamically adjust concurrency and throughput ceilings according to your merchant tier (Starter, Pro, Agency/Enterprise). When thresholds are exceeded, standard HTTP 429 Too Many Requests headers are returned.
Webhook HMAC Verification & Dead-Letter Delivery Resilient Ingestion
Inbound Shopify and Lemon Squeezy webhooks are cryptographically authenticated via SHA-256 HMAC signatures before request bodies are processed. Ingestion occurs asynchronously in <5ms. Any outbound webhook dispatch failures are persisted into a dedicated dead-letter queue (failed_webhooks) with exponential backoff and replay capability.
Verification Endpoints
Trigger on-demand refund scans and policy evaluations programmatically using your merchant API key.
HTTP Request Headers
Your merchant API key (e.g. pal_live_...).
Must be application/json.
Request Body Example
{
"order_id": "shopify-order-9842",
"text": "Customer claims item arrived damaged with torn outer packaging.",
"amount": 149.00,
"currency": "USD",
"priority": 5
}Async Ticket Response
{
"status": "ACCEPTED",
"job_id": 142,
"check_status_url": "/api/job-status/142",
"timestamp": "2026-09-11T01:50:00.000Z"
}