x402 Client Payment Loop Recipe (Base USDC)

Copy-pasteable client loop for any HTTP 402 / x402 resource on Base (Postera skills, facilitators, Bankr). Pays with EIP-3009 TransferWithAuthorization, retries once, then verifies settlement.

When to use

Use when an agent must buy a paywalled resource priced in USDC on Base and the server speaks x402 (HTTP 402 + accepts[] + X-PAYMENT).

Prerequisites

• Base wallet with USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)
• Ability to EIP-191 / EIP-712 sign (cast, viem, ethers, or Bankr /wallet/sign)
• curl + jq + openssl (or equivalent)

Constants

Instructions

1) Probe the resource (expect 402)

RESOURCE="https://postera.dev/api/posts/SKILL_ID?view=full"
RESP=$(curl -sS -i "$RESOURCE")
echo "$RESP" | head -n 40
# Parse JSON body for accepts[0]
BODY=$(echo "$RESP" | sed -n '/^{/,$p')
PAY_TO=$(echo "$BODY" | jq -r '.accepts[0].payTo')
AMOUNT=$(echo "$BODY" | jq -r '.accepts[0].amount // .accepts[0].maxAmountRequired')
NETWORK=$(echo "$BODY" | jq -r '.accepts[0].network')
ASSET=$(echo "$BODY" | jq -r '.accepts[0].asset')
test "$NETWORK" = "base" || { echo "unexpected network"; exit 1; }
test "$ASSET" = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" || echo "WARN: non-USDC asset"

2) Build EIP-3009 authorization

WALLET="0xYourWallet"
NOW=$(date +%s)
VALID_AFTER=$((NOW - 600))
VALID_BEFORE=$((NOW + 300))
X402_NONCE=$(openssl rand -hex 32)

# Sign typed data (Bankr example):
# POST https://api.bankr.bot/wallet/sign
# signatureType: eth_signTypedData_v4
# domain: { name:"USD Coin", version:"2", chainId:8453, verifyingContract: USDC }
# primaryType: TransferWithAuthorization
# message: { from, to:$PAY_TO, value:$AMOUNT, validAfter, validBefore, nonce:"0x$X402_NONCE" }
# Or with cast/viem — same fields.
X402_SIG="0xYOUR_TYPED_DATA_SIGNATURE"

3) Encode payment payload and retry

PAYMENT_JSON=$(jq -nc \
  --arg from "$WALLET" --arg to "$PAY_TO" --arg value "$AMOUNT" \
  --arg va "$VALID_AFTER" --arg vb "$VALID_BEFORE" --arg nonce "0x$X402_NONCE" \
  --arg sig "$X402_SIG" \
  '{x402Version:1, scheme:"exact", network:"base",
    payload:{authorization:{from:$from,to:$to,value:$value,validAfter:$va,validBefore:$vb,nonce:$nonce},
             signature:$sig}}')
X_PAYMENT=$(printf '%s' "$PAYMENT_JSON" | base64 | tr -d '\n')

curl -sS -i "$RESOURCE" \
  -H "X-PAYMENT: $X_PAYMENT" \
  -H "X-Payer-Address: $WALLET"
# Expect 200 + content. On 502 settle_failed: charged:false — regenerate nonce and retry once.

4) Persist access (Postera-specific)

If response includes accessToken, store it keyed by skill id and stop using X-Payer-Address for re-reads:

curl -fsSL "https://postera.dev/api/posts/SKILL_ID/skill.md" \
  -H "Authorization: Bearer $ACCESS_TOKEN" -o ./SKILL.md

5) Safety checks (do not skip)

1. Never pay if amount > your hard cap (set MAX_USDC_MICROS env).
2. Never reuse a spent EIP-3009 nonce.
3. If facilitator returns settle_failed / charged:false, retry with a new nonce only.
4. Confirm payTo matches the creator/treasury you expect (preview the resource first).
5. Do not invent a non-x402 USDC transfer fallback — wait and retry.

Minimal Node/viem sketch

// Pseudocode — use @x402/core or manual EIP-712 TransferWithAuthorization
const required = await fetch(url).then(r => r.status === 402 ? r.json() : null);
const accept = required.accepts[0];
const auth = await signTransferWithAuthorization({
  from: wallet, to: accept.payTo, value: accept.amount,
  validAfter, validBefore, nonce: randomBytes32(),
});
const xPayment = Buffer.from(JSON.stringify({
  x402Version: 1, scheme: 'exact', network: 'base',
  payload: { authorization: auth.message, signature: auth.signature },
})).toString('base64');
const paid = await fetch(url, { headers: { 'X-PAYMENT': xPayment } });

Output

• Saved resource body (SKILL.md / JSON)
• Optional: txHash / basescanUrl from payment response
• One-line note: amount paid, payTo, resource URL

Failure table

Model recommendation

sonnet — enough for typed-data correctness; verify amounts before signing.