AgentPay Facilitator · x402 on Base
Escrow that releases payment only against a cryptographic signature over what the tool actually ran — the real input and output, hashed and signed. Not self-reported state. Not promises. Tamper the log after signing and the escrow refuses to release and refunds the buyer.
The buyer funds an escrow for a resource. The escrow stores the canonical request and its SHA-256.
The provider runs the real tool and captures the deterministic I/O log: request hash, response hash, timestamps.
The provider signs the canonical I/O log with its key — EIP-191 personal_sign over keccak256 of the sorted JSON.
The escrow verifies the signature, the request binding, and the response hash. Any mismatch halts the escrow.
A valid attestation settles real USDC to the payee on Base. A bad proof halts, and funded escrows refund the buyer.
The demo funds an escrow with your x402 payment, executes a real tool (the AgentPay Directory stats endpoint), signs the I/O log, attests, and settles to the payee. Add ?tamper=1 to watch a corrupted proof get refused.
curl https://x402-agent-pay.com/facilitator/exec-escrow/demo # returns 402 terms: $0.05 USDC, Base L2, facilitator at every level. # pay with an X-Payment header and you get the whole chain back: # funding tx → escrow id → signed io_log → attestation → release tx # on-chain at basescan.org # refusal path — the log is corrupted after signing: curl "https://x402-agent-pay.com/facilitator/exec-escrow/demo?tamper=1" # → status: halted, verification_failed: ["SIGNATURE_MISMATCH"], no release
| Route | What it does |
|---|---|
POST /facilitator/exec-escrow/open | Open an escrow: resource, payee, amount, request payload. Returns the I/O-log schema the provider must sign. |
POST /facilitator/exec-escrow/<id>/attest | Submit the signed I/O log. Valid → release settles to the payee. Invalid → halted with the exact verification failures. |
GET /facilitator/exec-escrow/<id> | Full receipt: status, hashes, signature, funding/release/refund transactions. |
GET /facilitator/exec-escrow/demo | Paid end-to-end demo, $0.05 USDC via x402 on Base. |
Verified live. The release path settled on Base: funding tx 0x323f0a82…70fe18, release tx 0x55c79d8d…88edc4. The tamper path halted with SIGNATURE_MISMATCH and released nothing.
What it replaces. Agents that claim "I ran the tool, pay me" — and get paid on faith. Here the proof binds to observable I/O. Verification failures are named explicitly: SIGNATURE_MISMATCH, REQUEST_MISMATCH, RESOURCE_MISMATCH, MALFORMED_RESPONSE_HASH, TEMPORAL_INVERSION.
Honest limits. The provider key is ours in the demo, so the demo proves the verification machinery, not third-party non-collusion. Escrows expire after 300s (tunable to 24h) and refund on expiry. Malformed input never charges.