tempo-x402-node 1.6.0

Clients sign EIP-712 payment authorizations, servers gate content behind 402 responses, and a facilitator settles payments on-chain via transferFrom — all in a single request/response cycle. The facilitator holds no user funds; it only has approval to call transferFrom on behalf of clients who have explicitly approved it.

Nodes are autonomous agents — they bootstrap their own identity, run a gateway, think via an LLM-powered soul, create services, clone themselves, and coordinate with peers.

Payment flow

Client                     Server                    Facilitator               Chain
  |  GET /resource           |                            |                      |
  |------------------------->|                            |                      |
  |  402 + price/token/to    |                            |                      |
  |<-------------------------|                            |                      |
  |  [sign EIP-712]          |                            |                      |
  |  GET /resource           |                            |                      |
  |  + PAYMENT-SIGNATURE     |                            |                      |
  |------------------------->|  POST /verify-and-settle   |                      |
  |                          |--------------------------->|  transferFrom()      |
  |                          |                            |--------------------->|
  |                          |         settlement result  |              tx hash |
  |                          |<---------------------------|<---------------------|
  |  200 + content + tx hash |                            |                      |
  |<-------------------------|                            |                      |

1. Client requests a protected endpoint
2. Server responds 402 with pricing (token, amount, recipient)
3. Client signs an EIP-712 PaymentAuthorization, retries with PAYMENT-SIGNATURE header
4. Facilitator atomically verifies signature, checks balance/allowance/nonce, calls transferFrom
5. Server returns content + transaction hash

Quick start

cargo add tempo-x402

Make a paid request

use alloy::signers::local::PrivateKeySigner;
use x402::client::{TempoSchemeClient, X402Client};

#[tokio::main]
async fn main() {
    let signer: PrivateKeySigner = "0xYOUR_PRIVATE_KEY".parse().unwrap();
    let client = X402Client::new(TempoSchemeClient::new(signer));

    let (response, settlement) = client
        .fetch("https://your-gateway.example.com/g/my-api/data", reqwest::Method::GET)
        .await
        .unwrap();

    println!("{}", response.text().await.unwrap());
    if let Some(s) = settlement {
        println!("tx: {}", s.transaction.unwrap_or_default());
    }
}

Monetize any API

No code changes needed — the gateway proxies requests and handles payment:

# Register an endpoint
curl -X POST https://your-gateway.example.com/register \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <base64-payment>" \
  -d '{"slug": "my-api", "target_url": "https://api.example.com", "price": "$0.05"}'

# Clients pay through the gateway
curl https://your-gateway.example.com/g/my-api/users/123 \
  -H "PAYMENT-SIGNATURE: <base64-payment>"

Target APIs receive verification headers: X-X402-Verified, X-X402-Payer, X-X402-Amount, X-X402-TxHash.

Workspace

crates/
  tempo-x402/               Core library: types, EIP-712, TIP-20, nonce store, wallet, client SDK
  tempo-x402-gateway/       API gateway + embedded facilitator + payment middleware
  tempo-x402-identity/      Wallet generation, persistence, faucet, on-chain ERC-8004 identity
  tempo-x402-soul/          Autonomous cognition: plan-driven execution, neuroplastic memory, coding agent
  tempo-x402-node/          Self-deploying node: gateway + identity + soul + clone orchestration
  tempo-x402-app/           Leptos WASM dashboard (not published)
  tempo-x402-security-audit/  Security invariant tests (not published)

Feature flags

Autonomous nodes

Nodes are self-managing agents that:

• Bootstrap identity — generate wallet, fund via faucet, register on-chain
• Run a gateway — serve endpoints, process payments, proxy upstream APIs
• Think autonomously — plan-driven execution loop powered by Gemini with neuroplastic memory
• Write code — read, write, edit files, run shell commands, commit, push, open PRs
• Create services — script endpoints exposing the node's capabilities
• Clone themselves — spawn copies on Railway infrastructure
• Coordinate with peers — discover siblings, exchange endpoint catalogs, call paid services
• Evolve via fitness — 5-component fitness score (economic, execution, evolution, coordination, introspection) with trend gradient

Gateway API

Network

Prerequisites

# Fund your wallet with testnet pathUSD
cast rpc tempo_fundAddress 0xYOUR_ADDRESS --rpc-url https://rpc.moderato.tempo.xyz

# Approve the facilitator to spend your tokens
cargo run --bin x402-approve

Or programmatically:

use x402::tip20;
tip20::approve(&provider, token, facilitator_address, amount).await?;

Environment variables

See each crate's CLAUDE.md for the full list.

Security

The tempo-x402-security-audit crate enforces invariants on every build:

• No hardcoded private keys in production code
• HMAC verification uses constant-time comparison (subtle crate)
• All reqwest clients disable redirects (SSRF protection)
• Webhook URLs require HTTPS with private IP blocking
• HTTP error responses never leak internal details
• SQLite nonce store required in production
• Parameterized SQL queries only
• Private keys never appear in tracing output

Additional hardening: EIP-2 high-s rejection, per-payer mutex locks against TOCTOU, nonces claimed before transferFrom (never released on failure), integer-only token arithmetic, SSRF protection with DNS validation, atomic slug reservation.

Live nodes

Health: GET /health — Info: GET /instance/info

Development

cargo build --workspace
cargo test --workspace
cargo clippy --workspace -- -D warnings
cargo fmt --all -- --check

License

MIT