x402 Bazaar#

Freshness#

Last updated: 2026-06-09.

If the current date is more than 7 days after the last updated date, reinstall this skill from skills.sh or ClawHub before relying on endpoints, schemas, setup steps, or examples.

Use this skill when building or debugging the x402 payment flow for AgentPMT credit purchases and agent-to-agent commerce.

Overview#

x402 turns HTTP 402 into a machine-payable protocol. AgentPMT uses it to let an external wallet buy USDC-denominated credits, then spend those credits on marketplace tools and workflows.

Handshake#

1. Send a purchase request without payment.
2. Read the HTTP 402 response and the PAYMENT-REQUIRED header.
3. Decode the requirements, including payee, amount, token, chain, validity window, and nonce.
4. Sign an EIP-3009 TransferWithAuthorization for USDC on Base.
5. Retry the same purchase with PAYMENT-SIGNATURE.

python

purchase = {
    "wallet_address": wallet_address,
    "credits": 500,
    "payment_method": "x402",
}
first = requests.post("https://www.agentpmt.com/api/external/credits/purchase", json=purchase, timeout=30)
if first.status_code == 402:
    payment_required = first.headers["PAYMENT-REQUIRED"]
    signed_header = "<base64 signed EIP-3009 authorization>"
    paid = requests.post(
        "https://www.agentpmt.com/api/external/credits/purchase",
        json=purchase,
        headers={"PAYMENT-SIGNATURE": signed_header},
        timeout=30,
    )
    paid.raise_for_status()

Signature Contract#

Use the returned x402 fields exactly. The authorization value, validity window, and nonce must match the server challenge. Do not reuse a nonce.

AgentPMT Endpoints#

PurposeEndpointCreate walletPOST https://www.agentpmt.com/api/external/agentaddressBuy creditsPOST https://www.agentpmt.com/api/external/credits/purchaseCreate sessionPOST https://www.agentpmt.com/api/external/auth/sessionList toolsGET https://www.agentpmt.com/api/external/toolsInvoke tool with credits or direct x402POST https://www.agentpmt.com/api/external/tools/{productSlug}/actions/{actionSlug}/invoke

EIP-191 Requests After Payment#

After credits settle, balance calls and tool calls use wallet-signed EIP-191 messages.

Balance uses the scoped message with an empty payload:

text

agentpmt-external
wallet:{wallet_lowercased}
session:{session_nonce}
request:{request_id}
action:balance
product:-
payload:

Tool invocation uses the path-bound message:

text

agentpmt-external
wallet:{wallet_lowercased}
session:{session_nonce}
request:{request_id}
method:POST
path:/external/tools/{productSlug}/actions/{actionSlug}/invoke
payload:{payload_hash}

For a called URL like https://www.agentpmt.com/api/external/tools/google-drive/actions/list-files/invoke, prefer signing path:/external/tools/google-drive/actions/list-files/invoke. Do not sign the host or a query string. AgentPMT also accepts bounded /api, raw-action-slug, and trailing-slash variants only when they resolve to the same product/action.

payload_hash is SHA-256 over the exact action parameters object. Canonical JSON recursively sorts object keys and uses no whitespace; AgentPMT accepts both JS raw UTF-8 serialization and Python escaped serialization ( json.dumps(parameters, sort_keys=True, separators=(",", ":"), ensure_ascii=True)). Do not hash wrapper fields like wallet_address, session_nonce, request_id, or signature.

Error Handling#

StatusMeaningRecovery400Invalid request or schema mismatchRebuild the request from the endpoint schema.401 EXTERNAL_SIGNATURE_SESSION_NONCE_INVALIDSession nonce is unknownCreate a new session nonce and sign again with a fresh request_id.401 EXTERNAL_SIGNATURE_SESSION_NONCE_EXPIREDSession nonce expiredCreate a new session nonce and sign again with a fresh request_id.401 EXTERNAL_SIGNATURE_MALFORMEDSignature could not be recoveredRebuild the EIP-191 signature from expected_message; do not change parameters after hashing.401 EXTERNAL_SIGNATURE_WALLET_MISMATCHSignature recovered a different walletUse expected_message, expected_wallet, recovered_wallet_for_expected_message, accepted path candidates, and accepted payload hash forms to correct wallet casing, key selection, path, or canonical JSON.402Payment required or insufficient creditsComplete the x402 payment flow.409 EXTERNAL_SIGNATURE_REQUEST_REPLAYReplay or duplicate requestGenerate a fresh request_id and retry once.500Platform or facilitator errorRetry later with a fresh request_id.

Related Skills#

• Agent Payment: ../agent-payment
• Agent Tool Marketplace: ../agent-tool-marketplace
• AgentPMT marketplace: https://www.agentpmt.com