⚡ Paywright

The Postman for x402.

Test and inspect any x402 endpoint end to end: send a request, decode the 402 Payment Required challenge, pay in USDC from your wallet, and inspect the fully settled response, receipt and onchain trace included.

  Live: paywright.xyz   Built on x402

GET /endpoint → 402 Payment Required → sign (EIP-3009) → 200 OK + data

Live app · How it works · Features

---

This is a showcase repo. It presents the project as a case study. The app is live at paywright.xyz; the source is private and can be walked through on request.

---

🎬 Demo

Add a Loom/GIF here.

Request + 402 challenge	Settled response + receipt
docs/challenge.png	docs/receipt.png

It actually completes the loop: a real Base Sepolia trace

// 1 · unpaid request  →  HTTP 402
{
  "x402Version": 2,
  "error": "Payment required",
  "accepts": [{
    "scheme": "exact",
    "network": "eip155:84532",              // Base Sepolia
    "maxAmountRequired": "10000",            // 0.01 USDC (6 decimals)
    "asset": "0x036C…F7e",                   // USDC
    "payTo": "0x1111…1111"
  }]
}

// 2 · paid request  →  HTTP 200  (0.01 USDC settled onchain)
{ "amount": 1, "base": "USD", "date": "2026-07-02", "rates": { "EUR": 0.87727 } }

Paywright signed the payment (EIP-3009, gasless), the x402 facilitator settled the USDC transfer onchain, and the gated response was unlocked over plain HTTP, with a receipt you can click through to the block explorer.

---

🧩 Why

curl and Postman stop at the 402. They can't sign the payment and complete the request, so there's no easy way to actually test an x402-gated endpoint from a UI.

Paywright runs the whole loop:

GET /endpoint  →  402 Payment Required  →  sign (EIP-3009)  →  200 OK + data
                  (decode requirements)     (gasless)          (+ settlement receipt)

---

🏗️ How it works

                       ┌──────────────── Paywright ─────────────────┐
                       │                                            │
  you  ─── Send ──────▶│  same-origin proxy (SSRF-guarded, rated)   │──▶ x402 endpoint
                       │        │                                   │
                       │        ├─ 402 ─▶ decode requirements        │
                       │        │        (scheme, network, amount,   │
                       │        │         asset, payTo)              │
   sign EIP-3009  ◀────┼────────┘                                   │
   (client-side,       │                                            │
    wallet only)       │   retry with X-PAYMENT header              │
                       │        │                                   │
                       │        ├─ facilitator verifies + settles ──┼──▶ USDC onchain
                       │        ▼                                   │
  200 OK + receipt ◀───┼── unlocked response + settlement trace     │
                       └────────────────────────────────────────────┘

• Same-origin proxy. Requests to any endpoint go through a same-origin, SSRF-guarded, rate-limited proxy, so CORS never gets in the way and the browser only ever talks to Paywright.
• Client-side signing. The payment is signed in your wallet. The proxy only forwards the HTTP hop; it never touches keys.
• Settle-then-unlock. The facilitator verifies and settles the USDC transfer onchain, and only then is the gated response returned.

---

✨ Features

• Full x402 flow. Probe the 402, decode the payment requirements (scheme, network, amount, pay-to, asset), pay with a connected wallet, and get the unlocked response.
• Works on any endpoint. The same-origin, SSRF-guarded, rate-limited proxy means CORS never blocks a request.
• Settlement receipt. See the onchain transaction, with one-click links to the block explorer for the tx and the pay-to / asset addresses.
• Wallet-native. Connect any wallet (Reown AppKit), with a live USDC balance and a pre-flight check before you pay.
• Inspect everything. Tabbed response (body / headers / receipt), the raw payment challenge, and hover-to-reveal full addresses.
• Copy, share, export. Copy any value, share a request as a link (?url=...), or export it as a cURL command or a fetch snippet.
• Request history. Recent endpoints saved locally, one click to rerun.

---

🛠️ Tech stack

Layer	Choice
Framework	Next.js (App Router) + TypeScript, single repo
x402 client	@x402/fetch (wrapFetchWithPayment), @x402/core, @x402/evm
Wallet + signing	wagmi + viem + Reown AppKit
Network	Base (Base Sepolia in this build) · USDC · EIP-3009
Proxy	Same-origin route handler, SSRF-guarded + rate-limited
Data / UX	TanStack Query, sonner toasts, local request history
Styling	Tailwind CSS v4, custom theme

---

🗺️ Roadmap

• Full unpaid → sign → paid loop against any x402 endpoint
• Settlement receipt with block-explorer links
• Share-as-link, export to cURL / fetch
• Multichain (Base mainnet, other EVM networks) + stablecoin choice
• Saved collections and environments (Postman-style)
• Scriptable / CI mode for automated x402 endpoint testing
• Agent flows: spend limits and budget guardrails

---

💡 Why I built this

x402 is one of 2026's fastest-moving standards for internet-native, agent-driven payments, but the tooling around it is thin. When I was building x402 endpoints I kept wanting a Postman that could actually pay: probe the 402, sign, settle, and show me the whole trace. Nothing did it, so I built it. Paywright is the client I wanted while shipping onchain-metered APIs.

---

📄 License

The product is licensed AGPL-3.0: free to use, study, modify, and self-host; run a modified version as a network service and you must share your source under the same license. This showcase repo is a case study of that work.

---

Built on the x402 protocol by web3xDev