Add x402 provider verification abstraction for paid-action endpoint#324
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
POST /api/examples/x402-paid-actionendpoint for real x402 provider verification while preserving the existing demo accepted-envelope behavior.Description
lib/x402ProviderVerification.jswhich selects verification mode (demo_accepted_envelopeorprovider_verified) based onX402_PROVIDER_VERIFICATION_URLand implements server-side POST verification including optionalAuthorization: Bearer <X402_PROVIDER_API_KEY>.api/examples/x402-paid-action.jsto callverifyWithProviderserver-side before signing, to map provider failures to400/402/503as specified, and to includepayment_verification_modeplus safe provider metadata in receipts.tests/api-x402-paid-action.test.jsto cover demo mode, provider success, provider rejection, provider unavailable/malformed responses, non-leakage of the provider API key, and local receipt verification after provider success.docs/integrations/x402-commandlayer-receipts.mdto document the two verification modes, required env vars, failure mappings, and the trust boundary between payment verification and CommandLayer execution receipts.Testing
npm test, all automated tests passed (existing and new paid-action tests succeeded).npm run check:links, all local links resolved successfully.demo_accepted_envelopeoutput,provider_verifiedflow and metadata exposure, provider rejection mappings, provider unavailability handling, and thatX402_PROVIDER_API_KEYis not leaked in responses.Codex Task