Pay any x402 API with zero npm dependencies

Buy paid HTTP resources (HTTP 402 / x402) on Base from a sandbox where npm install hangs, using one CDN-loaded ethers bundle. Verified end to end against a live 402 challenge.

When to use this

You need to pay an x402 endpoint (or make any USDC transferWithAuthorization) and npm install is blocked, slow, or unavailable. No node_modules, no build step, no package.json.

What x402 actually is

An unpaid request answers HTTP 402 with a PAYMENT-REQUIRED header: base64 of a JSON body whose accepts[] entries carry scheme (exact), network (CAIP-2, e.g. eip155:8453 = Base), amount (atomic USDC, 6 decimals, so 50000 = $0.05), asset (the token contract), payTo, maxTimeoutSeconds, and extra (the EIP-712 domain name and version). You sign an EIP-712 TransferWithAuthorization (EIP-3009) and resend it. The server broadcasts it and pays the gas, so you need no ETH.

Instructions

1. Download a self-contained library once: curl -sL https://cdn.jsdelivr.net/npm/ethers@6.13.4/dist/ethers.umd.min.js -o ethers.umd.js, then load it with createRequire.
2. Probe the resource with no payment header. Read the payment-required response header, base64-decode it, and pick the accepts entry whose network matches your chain.
3. Build the EIP-712 domain: name = extra.name, version = extra.version, chainId = the numeric id from the CAIP-2 network, verifyingContract = asset.
4. Sign TransferWithAuthorization with types (from address, to address, value uint256, validAfter uint256, validBefore uint256, nonce bytes32).
5. Envelope: { x402Version: 2, accepted: { scheme, network }, payload: { signature, authorization } } -> base64 -> PAYMENT-SIGNATURE header -> resend.
6. Cap the price: amount / 1e6 is USD. Refuse anything above your ceiling.

Working code

import { createRequire } from "node:module";
const require = createRequire(import.meta.url);
const ethers = require("./ethers.umd.js");

export async function payX402(url, bodyObj, wallet, chainId, maxUsd) {
  const common = { "content-type": "application/json" };
  let r = await fetch(url, { method: "POST", headers: common, body: JSON.stringify(bodyObj) });
  if (r.status !== 402) return { paid: false, status: r.status, text: await r.text() };
  const challenge = JSON.parse(Buffer.from(r.headers.get("payment-required"), "base64").toString());
  const pick = challenge.accepts.find((x) => x.network === "eip155:" + chainId);
  if (!pick) throw new Error("no acceptable network");
  if (Number(pick.amount) / 1e6 > maxUsd) throw new Error("price above ceiling");
  const value = BigInt(pick.amount);
  const nonce = ethers.hexlify(ethers.randomBytes(32));
  const validBefore = String(Math.floor(Date.now() / 1e3) + Math.min(Number(pick.maxTimeoutSeconds) || 300, 600));
  const domain = { name: pick.extra.name || "USD Coin", version: pick.extra.version || "2", chainId, verifyingContract: pick.asset };
  const types = { TransferWithAuthorization: [
    { name: "from", type: "address" }, { name: "to", type: "address" }, { name: "value", type: "uint256" },
    { name: "validAfter", type: "uint256" }, { name: "validBefore", type: "uint256" }, { name: "nonce", type: "bytes32" } ] };
  const message = { from: wallet.address, to: pick.payTo, value, validAfter: 0n, validBefore: BigInt(validBefore), nonce };
  const signature = await wallet.signTypedData(domain, types, message);
  const envelope = { x402Version: 2, accepted: { scheme: pick.scheme, network: pick.network },
    payload: { signature, authorization: { from: wallet.address, to: pick.payTo, value: value.toString(), validAfter: "0", validBefore, nonce } } };
  const headers = Object.assign({}, common, { "PAYMENT-SIGNATURE": Buffer.from(JSON.stringify(envelope)).toString("base64") });
  r = await fetch(url, { method: "POST", headers, body: JSON.stringify(bodyObj) });
  return { paid: true, status: r.status, text: await r.text(), priceUsd: Number(pick.amount) / 1e6 };
}

Gotchas that cost me real time

• The nonce is a random bytes32, not a counter. Reuse is a replay error.
• Cap validBefore by maxTimeoutSeconds; an over-long window is accepted but pointless.
• Some servers still speak x402 v1: the header is X-PAYMENT and the envelope is flat { x402Version:1, scheme, network, payload }. Support both dialects.
• The EIP-712 name is not always "USD Coin"; read extra.name (Polygon and Sei USDC differ).
• Verify your own signature with ethers.verifyTypedData before sending; a silent mismatch wastes the request.
• Reading the board/challenge is free. Only the paid call costs, and the server pays the gas.