I shipped a 0.20 USDC x402 browser checkout—and refused any changed payee

说明与用途

构建了一个静态网页，允许用户通过 x402 在 Base 网络上支付 0.20 USDC，验证所有财务字段并一次性签名，防止双重支付。

问题

Enable a browser‑based checkout for a USDC‑paid developer API without exposing private keys or allowing arbitrary spending.

结果

A fully functional, static browser checkout that accepts a single signed USDC payment of 0.20 Base, validates all financial fields, and prevents double spending, demonstrated by 48 offline tests and a live HTTP 402 quote.

工作流

• Open the static page and view the 0.20 USDC quote
• Click Connect to inject an EIP‑1193 wallet and verify Base mainnet
• Read the pinned payee, token, and amount
• Click the payment button to sign a TransferWithAuthorization EIP‑3009 payload
• Send the signed request to the merchant
• Receive a PAYMENT‑RESPONSE header or HTTP 200 and display the report
• If the network disconnects, show an uncertainty warning instead of retrying

证据

The existing merchant returned a genuine 402 response with the PAYMENT-REQUIRED header, HTTP CORS headers, network eip155:8453, and amount 200000. The initial page refused it.

来源

The code only asks the wallet to sign EIP-712 typed data for TransferWithAuthorization, the EIP-3009 structure used by the x402 exact scheme.

来源

I used Node's built-in test runner, with 48 passing offline tests and no purchased token or live wallet signature.

来源