x402 + EIP-3009

PowaAgent pays APIs using two open standards:

• x402, for the conversation between your agent and a paid API over HTTP.
• EIP-3009, the USDC feature that lets a signed message move funds without the payer sending a transaction.

You don't need to know either to use PowaAgent. This page explains the headers and fields you'll see if you look at the traffic.

The x402 exchange#

GET /resource
  ←  402 Payment Required
     PAYMENT-REQUIRED: <base64 JSON: payment terms>

GET /resource
  →  PAYMENT-SIGNATURE: <base64 JSON: signed payment>
  ←  200 OK
     PAYMENT-RESPONSE: <base64 JSON: settlement receipt>
     { ...data... }

Older x402 version 1 sellers use X-PAYMENT and X-PAYMENT-RESPONSE instead. PowaAgent supports both versions.

The payment terms#

The 402 response lists one or more ways to pay in an accepts array. Here's an example entry (illustrative values):

{
  "scheme": "exact",
  "network": "eip155:8453",
  "amount": "2000",
  "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "payTo": "0x1111111111111111111111111111111111111111",
  "maxTimeoutSeconds": 300,
  "extra": { "name": "USD Coin", "version": "2" }
}

• network uses the eip155:<chain id> format. Base mainnet is eip155:8453, and Base Sepolia (the sandbox) is eip155:84532.
• amount is in USDC base units, where 1 USDC = 1,000,000. So 2000 is 0.002 USDC.
• asset is the USDC contract on Base.
• extra.name and extra.version describe the token for signing. PowaAgent needs them to build the signature.

When an API offers several options, the connector picks the exact USDC option on Base, on Base mainnet for production calls and on Base Sepolia in the sandbox.

The signed payment#

PowaAgent signs an EIP-3009 TransferWithAuthorization message from your wallet:

TransferWithAuthorization(
  from         your wallet
  to           the payTo address
  value        the amount
  validAfter   0
  validBefore  now + up to 120 seconds
  nonce        32 random bytes
)

The signature is built from the seller's own payment terms:

• Name and version come from extra.
• Chain id comes from network.
• Contract is the asset.

Three properties keep it safe:

1. You never send a transaction. The seller's payment processor submits the signed message and pays the network fee.
2. It can be used only once. The USDC contract rejects a nonce it has already seen.
3. It expires. validBefore is set to the earlier of 120 seconds from signing and the seller's maxTimeoutSeconds. After that the signature can't be used.

The receipt#

The PAYMENT-RESPONSE header carries the settlement result. The connector reads its transaction hash into the receipt it returns:

"receipt": {
  "payment_required": true,
  "amount_usdc": "0.002",
  "amount_atomic": 2000,
  "pay_to": "0x1111111111111111111111111111111111111111",
  "network": "eip155:8453",
  "tx_hash": "0x2222222222222222222222222222222222222222222222222222222222222222",
  "sandbox": false
}

Paste the tx_hash into basescan.org, or sepolia.basescan.org for sandbox payments, to see the transfer.

What PowaAgent adds#

The standards define how to ask for and make a payment. PowaAgent adds:

• Signing from your wallet, without your agent holding a key. See Delegated Signing grant.
• A source policy check before every signature. See Source policy.
• The full exchange, handled for you by the connector and the Skill.

For direct integration, see Sign a payment.