x402 Quickstart

Deploy x402 pay-per-call API endpoints in minutes. Turn any OpenClaw skill or service into a monetized endpoint accepting USDC on Base. Includes payment veri...

Security Scan

The skill and included scaffold are coherent with the stated purpose (creating a pay-per-call x402 endpoint) and do not request disproportionate credentials or perform unexpected actions.

Purpose & Capability

Name/description (x402 pay-per-call endpoints) align with the code and instructions: the bundle provides a scaffolded Express server, on-chain USDC verification via ethers, and Cloudflare/Spraay integration. Nothing in the files requires unrelated access (no cloud provider keys, no system-wide credentials). One minor mismatch: registry metadata lists no required env vars, but the scaffold generates and expects a .env with WALLET_ADDRESS, USDC_CONTRACT, CHAIN_ID, etc. This is reasonable for runtime configuration but should be noted.

Instruction Scope

SKILL.md and scaffold.sh focus on deploying and exposing a payment-gated endpoint and instruct the user to expose it publicly (cloudflared) and optionally register it with Spraay. The instructions do not ask the agent to read arbitrary host files or secret stores. Note: publishing the endpoint (cloudflared + Spraay) makes it publicly discoverable and increases risk surface; the instructions do not discuss persistence of replay protection beyond memory.

Install Mechanism

This is an instruction-only skill with a scaffold script; there is no automatic installer or remote download. The scaffold writes a project to disk only when the user runs the script. Dependencies (express, ethers, dotenv) are standard npm packages — no untrusted URLs or archives are used.

Credentials

The runtime requires typical configuration values (recipient wallet address, USDC contract, RPC URL). These are proportional to the described purpose. None of the code requests private keys or other secrets. However, the registry metadata omitted required envs while the scaffold creates a .env file that the server expects; users should supply only the public WALLET_ADDRESS (recipient) and not private keys.

Persistence & Privilege

The skill is not always-enabled and does not request or modify other skills' configurations. It does keep an in-memory usedTxHashes set for replay protection, which is ephemeral (lost on restart) — this is expected behavior for a simple scaffold but worth hardening in production.

Assessment

This scaffold appears to do what it says: create a pay-per-call Express endpoint that verifies USDC payments on Base. Before running or publishing: 1) Review and set WALLET_ADDRESS in the generated .env (this is a recipient address only — do NOT put private keys there). 2) Test locally first (pricing and health endpoints are free) and inspect the verifyPayment logic to ensure it matches your security needs (log parsing, decimals, chain/RPC). 3) Be aware replay protection is in-memory only; consider persistent tracking to avoid reuse after server restart. 4) Exposing via cloudflared or registering with Spraay makes the service public — ensure you understand the privacy and abuse implications. 5) Confirm you have required tooling (node/npm, python3 used briefly in the scaffold) and review dependencies before running npm install. If you need tighter guarantees (stronger on-chain verification, rate-limiting, fraud detection, persistent receipts), plan to extend the scaffold accordingly.

Deploy x402-compatible pay-per-call endpoints that accept USDC payments from AI agents on Base.

What is x402?

HTTP 402 ("Payment Required") is the standard for machine-to-machine payments. An agent sends a request, gets a 402 response with pricing info, pays in USDC on Base, and receives the data. No API keys, no accounts, no subscriptions.

Ecosystem (Q1 2026): Stripe, Cloudflare, Google (AP2), Coinbase all ship native x402 support.

Quick Deploy

1. Generate endpoint scaffold

bash scripts/scaffold.sh my-service "My cool API" 0.01

Creates a ready-to-run Express server with x402 payment middleware at ./my-service/.

2. Configure wallet

Set your Base wallet address to receive payments:

# In the generated .env file
WALLET_ADDRESS=0xYourBaseWalletAddress
USDC_CONTRACT=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
CHAIN_ID=8453
PORT=3402

3. Run locally

cd my-service && npm install && node server.js

4. Expose via Cloudflare Tunnel (zero cost)

cloudflared tunnel --url http://localhost:3402

How It Works

Agent Flow

Agent → GET /api/data → 402 Payment Required
                         ├── price: "0.01 USDC"
                         ├── payTo: "0x..."
                         └── network: "base"
Agent → pays USDC on Base → gets tx hash
Agent → GET /api/data (X-Payment-Tx: 0x...) → 200 OK + data

Server Flow

1. Request arrives without payment → respond 402 with pricing
2. Request arrives with X-Payment-Tx header → verify on-chain
3. If payment confirmed → serve data
4. If payment fails → respond 402 again

Endpoint Ideas

High-value endpoints AI agents will pay for:

Endpoint	Price	Description
/alpha/scan	$0.50-1.00	Token/project analysis with scoring
/market/signal	$0.10	Real-time trading signals
/research/report	$1.00	Deep research on any topic
/data/portfolio	$0.05	Multi-chain portfolio snapshot
/tools/scrape	$0.02	Clean web content extraction
/ai/inference	$0.04	LLM inference routing

Payment Verification

The scaffold includes scripts/verify-payment.js for on-chain verification:

// Verifies USDC transfer on Base
const verified = await verifyPayment(txHash, expectedAmount, recipientAddress);

Uses Base RPC (free tier) — no API key needed for basic verification.

Integration with OpenClaw

As a skill endpoint

Add to your agent's capabilities:

// In SKILL.md or agent config
{
  tools: [{
    name: "my_x402_service",
    endpoint: "https://my-service.example.com/api",
    payment: { currency: "USDC", network: "base" }
  }]
}

With Cloudflare Tunnel

Zero-cost hosting on your existing machine:

# One-time setup
cloudflared tunnel create my-x402
cloudflared tunnel route dns my-x402 api.mydomain.com

# Run
cloudflared tunnel run --url http://localhost:3402 my-x402

Spraay Gateway Integration

Register your endpoint on Spraay to get discovered by agents automatically:

curl -X POST https://gateway.spraay.app/register \
  -H "Content-Type: application/json" \
  -d '{"url": "https://api.mydomain.com", "category": "data", "price": "0.01"}'

Pricing Strategy

• Data endpoints: $0.005-0.05 (commodity, high volume)
• Analysis endpoints: $0.10-1.00 (value-add, medium volume)
• Research endpoints: $1.00-5.00 (premium, low volume)
• GPU/compute: $0.05-0.50 (resource-based pricing)

Start low, raise prices when you have traction. Better to have 1000 calls at $0.01 than 0 calls at $1.00.