X402 Bazaar

x402 Bazaar

Freshness

Last updated: 2026-06-09.

If the current date is more than 7 days after the last updated date, reinstall this skill from skills.sh or ClawHub before relying on endpoints, schemas, setup steps, or examples.

Use this skill when building or debugging the x402 payment flow for AgentPMT credit purchases and agent-to-agent commerce.

Overview

x402 turns HTTP 402 into a machine-payable protocol. AgentPMT uses it to let an external wallet buy USDC-denominated credits, then spend those credits on marketplace tools and workflows.

Handshake

1. Send a purchase request without payment.
2. Read the HTTP 402 response and the PAYMENT-REQUIRED header.
3. Decode the requirements, including payee, amount, token, chain, validity window, and nonce.
4. Sign an EIP-3009 TransferWithAuthorization for USDC on Base.
5. Retry the same purchase with PAYMENT-SIGNATURE.

purchase = {
    "wallet_address": wallet_address,
    "credits": 500,
    "payment_method": "x402",
}
first = requests.post("https://www.agentpmt.com/api/external/credits/purchase", json=purchase, timeout=30)
if first.status_code == 402:
    payment_required = first.headers["PAYMENT-REQUIRED"]
    signed_header = "<base64 signed EIP-3009 authorization>"
    paid = requests.post(
        "https://www.agentpmt.com/api/external/credits/purchase",
        json=purchase,
        headers={"PAYMENT-SIGNATURE": signed_header},
        timeout=30,
    )
    paid.raise_for_status()

Signature Contract

Use the returned x402 fields exactly. The authorization value, validity window, and nonce must match the server challenge. Do not reuse a nonce.

AgentPMT Endpoints

EIP-191 Requests After Payment

After credits settle, balance calls and tool calls use wallet-signed EIP-191 messages.

Balance uses the scoped message with an empty payload:

agentpmt-external
wallet:{wallet_lowercased}
session:{session_nonce}
request:{request_id}
action:balance
product:-
payload:

Tool invocation uses the path-bound message:

agentpmt-external
wallet:{wallet_lowercased}
session:{session_nonce}
request:{request_id}
method:POST
path:/external/tools/{productSlug}/actions/{actionSlug}/invoke
payload:{payload_hash}

For a called URL like https://www.agentpmt.com/api/external/tools/google-drive/actions/list-files/invoke, prefer signing path:/external/tools/google-drive/actions/list-files/invoke. Do not sign the host or a query string. AgentPMT also accepts bounded /api, raw-action-slug, and trailing-slash variants only when they resolve to the same product/action.

payload_hash is SHA-256 over the exact action parameters object. Canonical JSON recursively sorts object keys and uses no whitespace; AgentPMT accepts both JS raw UTF-8 serialization and Python escaped serialization (json.dumps(parameters, sort_keys=True, separators=(",", ":"), ensure_ascii=True)). Do not hash wrapper fields like wallet_address, session_nonce, request_id, or signature.

Error Handling

Related Skills

• Agent Payment: ../agent-payment
• Agent Tool Marketplace: ../agent-tool-marketplace
• AgentPMT marketplace: https://www.agentpmt.com