Every paid endpoint follows the same deterministic x402 flow. No API keys. No billing. No onboarding. An agent signs a single USDC authorization per call and the CDP facilitator settles it on-chain.
The agent makes a normal POST to any paid endpoint. The server replies HTTP 402 Payment Required with a base64-encoded payment challenge in the PAYMENT-REQUIRED response header.
curl -i -X POST https://achillesalpha.onrender.com/x402/validate \
-H 'Content-Type: application/json' \
-d '{"agent_id":"your-agent","action":"trade","context":{"trade_value":1000}}'
HTTP/2 402
payment-required: <base64>
# decoded challenge
{
"x402Version": 2,
"error": "Payment required",
"resource": {
"url": "https://achillesalpha.onrender.com/x402/validate",
"description": "Full policy validation",
"mimeType": "application/json"
},
"accepts": [{
"scheme": "exact",
"network": "eip155:8453",
"amount": "10000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"payTo": "0x069c6012E053DFBf50390B19FaE275aD96D22ed7",
"maxTimeoutSeconds": 300,
"extra": {"name": "USDC", "version": "2"}
}]
}
The agent constructs an EIP-3009 transferWithAuthorization for the exact amount to the payTo address on Base, signs it with its wallet key, then base64-encodes the resulting PaymentPayload.
No transaction is broadcast yet — the signature is the payment.
The agent reissues the same request with the signed payload attached as the X-PAYMENT header. The server verifies and settles through the CDP facilitator, then returns HTTP 200 with the resource plus a PAYMENT-RESPONSE header containing the settlement proof.
curl -i -X POST https://achillesalpha.onrender.com/x402/validate \
-H 'Content-Type: application/json' \
-H 'X-PAYMENT: <base64-signed-payload>' \
-d '{"agent_id":"your-agent","action":"trade","context":{"trade_value":1000}}'
HTTP/2 200
payment-response: <base64 settlement proof>
{
"validated": true,
"risk_score": 34,
"trust_level": "medium",
"proof_hash": "0xabc...",
"recommendation": "proceed"
}
No payment required — just confirms each route is live and the x402 handshake works end-to-end. Run this before integrating.
for p in validate noleak memguard riskoracle secureexec flowcore \
latest-signals signal-query intelligence-report; do
code=$(curl -sk -o /dev/null -w '%{http_code}' \
-X POST -H 'Content-Type: application/json' -d '{}' \
https://achillesalpha.onrender.com/x402/$p)
echo "$p $code"
done
# expected: every line prints 402