01 · GET
Call one stable URL
Request /api/x402-canary without credentials or inputs. The server returns HTTP 402 and a PAYMENT-REQUIRED header.
BASE USDC · X402 V2 · NO INPUT
One GET. No query string, request body, account, API key, or upstream data. The unpaid request returns exact Base USDC terms; the paid retry returns deterministic JSON and facilitator settlement evidence.
The 0.000001 USDC alternative is a direct Base USDC purchase with a permanent public receipt. It is separate from the standard browser and agent x402 settlement paths.
NO PRIVATE KEY INPUT
The page validates the unpaid challenge before requesting wallet access. It will accept only Base, official USDC, exactly 1000 atomic units, this fixed endpoint, and the published BountyWorth recipient.
Nothing is signed until the exact 402 terms are validated.
01 · GET
Request /api/x402-canary without credentials or inputs. The server returns HTTP 402 and a PAYMENT-REQUIRED header.
02 · PAY
Your x402 client signs the facilitator-compatible authorization for 1,000 atomic units of official Base USDC.
03 · RETRY
Retry the identical URL with PAYMENT-SIGNATURE. There is no request data to accidentally change between challenge and payment.
04 · PROVE
The JSON confirms the protected handler was released. The PAYMENT-RESPONSE header carries the facilitator's settlement evidence.
COPY · REVIEW · RUN LOCALLY
The example registers Base only, accepts only official Base USDC up to 1000 atomic units, and rejects any offer whose recipient is not the published BountyWorth address. The signing key stays in the buyer's own process and is never sent to this site.
Copy the three bounded steps, review the code and unpaid 402, then run it locally. The hidden terminal prompt avoids putting the key in the command itself. A successful call returns the protected JSON plus a PAYMENT-RESPONSE settlement header.
Compare with the official x402 client and spend-control documentation →
npm install @x402/core @x402/evm @x402/fetch viemimport { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";
const network = "eip155:8453";
const usdc = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
const seller = "0xc296911e58ad64172662a73663e177A207240bD0";
const privateKey = process.env.X402_PRIVATE_KEY;
if (!privateKey) throw new Error("Set X402_PRIVATE_KEY locally");
const signer = privateKeyToAccount(privateKey);
// local only; never send this key to BountyWorth
const client = x402Client.fromConfig({
schemes: [{ network, client: new ExactEvmScheme(signer) }],
spendControls: {
maxAmountPerPayment: "$0.001",
allowedAssets: [{ network, asset: usdc, maxAmountPerPayment: "1000" }],
},
policies: [(_version, offers) => offers.filter(
(offer) => offer.payTo.toLowerCase() === seller.toLowerCase(),
)],
});
const paidFetch = wrapFetchWithPayment(fetch, client);
const response = await paidFetch("https://bountyworth.amber-panda-3101.chatgpt.site/api/x402-canary");
if (!response.ok) throw new Error(`HTTP ${response.status}`);
console.log(await response.json());
console.log("PAYMENT-RESPONSE", response.headers.get("payment-response"));read -s X402_PRIVATE_KEY && export X402_PRIVATE_KEY
node x402-buy.mjs
unset X402_PRIVATE_KEYNothing is executed by this page.
DETERMINISTIC DELIVERY
The handler does not call an RPC, database, model, or third-party API. Its only job is to make the x402 payment path observable.
{
"product": "BountyWorth Base x402 Settlement Canary",
"paid": true,
"protocol": "x402-v2",
"network": "eip155:8453",
"amountAtomic": "1000",
"amountUsdc": "0.001",
"settlementEvidence": "Read PAYMENT-RESPONSE"
}BUYER FAQ
Yes. The canary has no login, API key, query string, request body, or upstream dependency. The unpaid GET returns the complete x402 v2 payment requirement.
No. The page validates the exact Base USDC terms first, then asks an injected wallet to sign the bounded EIP-3009 authorization locally. BountyWorth never receives wallet secrets.
No native ETH is requested by this checkout. The published facilitator submits the settlement while the buyer authorizes exactly 0.001 USDC.
A successful purchase returns both protected JSON and a PAYMENT-RESPONSE header containing a successful Base settlement transaction. The browser links that transaction to a public explorer.
The hosted lane uses the current 0.001 USDC minimum published by the xpay facilitator. The separate one-atomic checkout is a direct Base USDC transfer and is labeled accordingly.
EXACT SCOPE