@meshgateway/mpp-server

Charge for any endpoint over HTTP 402. This package implements the merchant side of the x402 "exact" scheme with Permit2 witness transfers: it issues the 402 challenge, verifies the signed authorization, and settles on-chain through a relayer. Funds move straight from the payer to your wallet; the relayer only pays gas and never touches the money.

Built for tokens without EIP-3009 support, starting with USDG on Robinhood Chain (eip155:4663).

Install

npm install @meshgateway/mpp-server viem

Protect an endpoint

Works anywhere web-standard Request/Response exist: Cloudflare Workers, Next.js route handlers, Bun, Deno, Node 18+.

import { protect, robinhoodUSDG } from '@meshgateway/mpp-server';

const merchant = robinhoodUSDG({
  price: '0.01', // USDG per request
  recipient: '0xYourWallet',
  relayerKey: process.env.RELAYER_PRIVATE_KEY,
  rpcUrl: process.env.ROBINHOOD_RPC_URL,
  description: 'Market signal feed',
});

export const GET = protect(merchant, async (request, payment) => {
  // Runs only after a settled payment.
  return Response.json({ signal: 'bullish', paidBy: payment.payer });
});

Unpaid requests get a 402 Payment Required with a machine-readable payment-required header. Paid requests run your handler and the response carries a payment-response header with the settlement transaction hash.

Manual control

If you want to run the flow yourself:

import { handlePayment } from '@meshgateway/mpp-server';

const outcome = await handlePayment(request, merchant);
if (outcome.type !== 'paid') return outcome.response; // 402 challenge or rejection
// outcome.txHash, outcome.payer, outcome.headers are yours

Lower-level pieces are exported too: challengeResponse, verifyAndSettle, paymentRequirements, settlementResponseHeader.

What verification checks

Before anything is broadcast, the signed authorization must pass all of:

• token, amount, and recipient match your merchant config exactly
• spender is pinned to the canonical x402ExactPermit2Proxy (0x402085c248EeA27D92E8b30b2C58ed07f9E20001)
• the EIP-712 signature recovers to the payer
• the authorization is inside its validity window
• the payer holds the balance and has approved Permit2

Settlement is simulated first, then broadcast by your relayer wallet calling settle on the proxy, which executes the Permit2 witness transfer payer to merchant. The witness pins the recipient, so a signature can never be redirected to another wallet.

Relayer requirements

The relayerKey wallet needs a small amount of native gas on the target chain. It signs settlement transactions only; it has no access to payer or merchant funds.

No code instead?

If you would rather not run a relayer or host anything, MeshGateway hosts this exact rail: point it at your API or file, set a price, and get a machine-payable endpoint plus a marketplace listing.

Scope and roadmap

• v0 supports the permit2 transfer method only. For EIP-3009 networks (USDC on Base) use the upstream mppx server toolkit.
• Planned: facilitator mode (delegate settlement to a hosted relayer), Express and Hono adapters, dynamic pricing per request.

Client counterpart: meshgateway/mpp-client.

License

MIT