x402 Protocol Explained:
How AI Agents Pay for APIs
with USDC in 2026

import express from "express";
import { ethers } from "ethers";

const app = express();
const BASE_RPC = "https://mainnet.base.org";
const USDC_BASE = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
const MY_WALLET = "0xF8cD900794245fc36CBE65be9afc23CDF5103042";

// Minimal ERC-20 ABI for event parsing
const ERC20_ABI = [
  "event Transfer(address indexed from, address indexed to, uint256 value)"
];

// x402 middleware: protect any route with USDC payment
function requirePayment(amountUSDC: string, description: string) {
  return async (req: express.Request, res: express.Response, next: express.NextFunction) => {
    const proof = req.headers["x-payment-proof"] as string;

    if (!proof) {
      // No payment proof: return 402 with terms
      res.status(402).json({
        error: "payment_required",
        amount: amountUSDC,
        currency: "USDC",
        network: "base",
        address: MY_WALLET,
        description,
        expires_in: 300,
      });
      return;
    }

    // Verify the payment on-chain
    try {
      const provider = new ethers.JsonRpcProvider(BASE_RPC);
      const receipt = await provider.getTransactionReceipt(proof);

      if (!receipt || receipt.status !== 1) {
        res.status(400).json({ error: "invalid_payment", message: "Transaction failed or not found" });
        return;
      }

      // Parse USDC Transfer event
      const iface = new ethers.Interface(ERC20_ABI);
      const transferLog = receipt.logs.find(log => {
        try {
          const parsed = iface.parseLog({ topics: [...log.topics], data: log.data });
          return parsed?.name === "Transfer"
            && parsed.args.to.toLowerCase() === MY_WALLET.toLowerCase()
            && log.address.toLowerCase() === USDC_BASE.toLowerCase();
        } catch { return false; }
      });

      if (!transferLog) {
        res.status(400).json({ error: "payment_not_found", message: "No USDC transfer to our address" });
        return;
      }

      const parsed = iface.parseLog({ topics: [...transferLog.topics], data: transferLog.data });
      const paidAmount = ethers.formatUnits(parsed!.args.value, 6);

      if (parseFloat(paidAmount) < parseFloat(amountUSDC)) {
        res.status(400).json({ error: "insufficient_payment", required: amountUSDC, received: paidAmount });
        return;
      }

      // Payment verified - proceed
      (req as any).payment = { txHash: proof, amount: paidAmount, from: parsed!.args.from };
      next();
    } catch (err) {
      res.status(500).json({ error: "verification_failed", message: "Could not verify payment" });
    }
  };
}

// Protected endpoint: $3.50 USDC for a proxy session
app.get("/v1/proxy/create",
  requirePayment("3.50", "1 GB mobile proxy bandwidth"),
  (req, res) => {
    const payment = (req as any).payment;
    res.json({
      status: "active",
      proxy: {
        host: "us-4g-7721.example.com",
        port: 5057,
        username: "agent_" + payment.txHash.slice(0, 8),
        password: generateSecurePassword(),
        protocol: "socks5",
      },
      payment: {
        tx_hash: payment.txHash,
        amount: payment.amount,
        currency: "USDC",
        network: "base",
      },
    });
  }
);

function generateSecurePassword(): string {
  return Math.random().toString(36).slice(2, 12);
}

app.listen(3000, () => console.log("x402-enabled API running on :3000"));