Forem: Murat Akdeniz

Building a Marketplace on x402: Gasless USDC Payments for AI Agents

Murat Akdeniz — Thu, 12 Feb 2026 19:41:42 +0000

x402 is getting a lot of attention right now. The protocol — open-sourced by Coinbase — revives HTTP 402 for native internet payments. Stripe, Cloudflare, and others have adopted it. But most of the content out there is protocol explainers and hello-world demos.

I've been building AgentStore, a marketplace for Claude Code plugins where publishers earn USDC for their agents. The entire payment system runs on x402. Here's what it's actually like to build on the protocol — the architecture decisions, the real code, and the things that surprised me.

What x402 Actually Does

x402 brings back HTTP 402 Payment Required. Your server returns a 402 with payment details. The client pays. The client retries with proof. Simple.

But the interesting part is how the payment happens. x402 uses EIP-3009 transferWithAuthorization — a standard that lets someone sign an off-chain message authorizing a USDC transfer. A relay wallet (the "facilitator") submits that authorization on-chain and pays the gas. The user never needs ETH.

Client                       Server                    Facilitator          USDC Contract
  │                            │                           │                     │
  │  GET /agent/access         │                           │                     │
  │───────────────────────────>│                           │                     │
  │                            │                           │                     │
  │  402 {amount, payTo, x402} │                           │                     │
  │<───────────────────────────│                           │                     │
  │                            │                           │                     │
  │  sign EIP-3009 auth        │                           │                     │
  │  (one signature, no ETH)   │                           │                     │
  │                            │                           │                     │
  │  POST /payments/submit {authorization}                 │                     │
  │───────────────────────────>│                           │                     │
  │                            │  /verify {authorization}  │                     │
  │                            │──────────────────────────>│                     │
  │                            │  /settle {authorization}  │                     │
  │                            │──────────────────────────>│                     │
  │                            │                           │  transferWith       │
  │                            │                           │  Authorization()    │
  │                            │                           │────────────────────>│
  │                            │                           │                     │
  │                            │  {tx_hash, proof}         │                     │
  │                            │<──────────────────────────│                     │
  │                            │                           │                     │
  │  {entitlement, install}    │                           │                     │
  │<───────────────────────────│                           │                     │

That's the real flow. One user signature, zero gas.

The 402 Response

When someone tries to access a paid agent without paying, the API returns this:

function createPaymentRequired(params) {
  return {
    amount: params.amount.toFixed(2),
    currency: 'USDC',
    payTo: params.payTo,
    resource: {
      type: 'agent',
      agent_id: params.agentId,
      description: params.agentName,
    },
    x402: {
      version: '1',
      chain_id: 1, // Ethereum mainnet
      token: '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48', // USDC
      facilitator: params.facilitatorEndpoint,
      domain: {
        name: 'USD Coin',
        version: '2',
        chainId: 1,
        verifyingContract: '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48',
      },
    },
    nonce: generateNonce(),
    expires_at: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
  };
}

The x402.domain field is the EIP-712 domain for USDC's transferWithAuthorization. The client needs it to construct the typed data for signing. The nonce and expiry prevent replay attacks.

The response goes back as HTTP 402 with an X-Payment-Required header:

return NextResponse.json(
  { error: 'Payment Required', code: 'PAYMENT_REQUIRED', payment: paymentRequired },
  { status: 402, headers: { 'X-Payment-Required': JSON.stringify(paymentRequired) } }
);

The EIP-3009 Authorization

This is the core of x402's gasless UX. The user signs EIP-712 typed data that authorizes a USDC transfer — but doesn't execute it. The typed data looks like:

interface TransferAuthorizationMessage {
  domain: {
    name: 'USD Coin',
    version: '2',
    chainId: 1,
    verifyingContract: '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48'
  },
  types: {
    TransferWithAuthorization: [
      { name: 'from', type: 'address' },
      { name: 'to', type: 'address' },
      { name: 'value', type: 'uint256' },
      { name: 'validAfter', type: 'uint256' },
      { name: 'validBefore', type: 'uint256' },
      { name: 'nonce', type: 'bytes32' }
    ]
  },
  primaryType: 'TransferWithAuthorization',
  message: {
    from: buyerAddress,
    to: publisherAddress,
    value: '500000', // 0.50 USDC (6 decimals)
    validAfter: '0',
    validBefore: deadline,
    nonce: randomBytes32
  }
}

The user's wallet signs this. No transaction, no gas. Just a signature over structured data that says "I authorize moving 0.50 USDC from my address to the publisher's address."

Settlement

The signed authorization gets submitted to the marketplace API, which forwards it to the facilitator:

// Step 1: Verify the authorization is valid
const verifyResponse = await fetch(`${FACILITATOR_ENDPOINT}/verify`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    authorization,
    payment_required,
    payer: wallet_address,
    fee_split: feeSplit,
  }),
});

// Step 2: Settle — facilitator submits to USDC on-chain
const settleResponse = await fetch(`${FACILITATOR_ENDPOINT}/settle`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    authorization,
    payment_required,
    payer: wallet_address,
    fee_split: feeSplit,
  }),
});

const proof = await settleResponse.json();
// proof: { tx_hash, block_number, status, confirmations }

The facilitator's relay wallet calls USDC's transferWithAuthorization(from, to, value, validAfter, validBefore, nonce, v, r, s) on-chain. The contract verifies the user's signature and moves USDC directly from buyer to seller. The relay pays gas but never touches the user's funds.

Fee Splitting

AgentStore takes a 20% platform fee. This is handled with integer microdollar arithmetic to avoid floating-point errors:

function calculateFeeSplit(amount: number) {
  const totalMicro = Math.round(amount * 1_000_000);
  const platformMicro = Math.round(totalMicro * PLATFORM_FEE_PERCENT / 100);
  const publisherMicro = totalMicro - platformMicro;
  return {
    platformAmount: (platformMicro / 1_000_000).toFixed(6),
    publisherAmount: (publisherMicro / 1_000_000).toFixed(6),
    platformAmountNum: platformMicro / 1_000_000,
    publisherAmountNum: publisherMicro / 1_000_000,
  };
}

USDC has 6 decimal places. Doing math in microdollars (integers) and converting at the end avoids the classic 0.1 + 0.2 !== 0.3 problem.

What Happens After Payment

Once the facilitator returns a proof with a tx_hash, the marketplace:

Creates an entitlement — a record that this wallet has access to this agent
Records a transaction — for earnings tracking and replay protection
Returns the agent's install instructions to the client

// Replay protection: reject if tx_hash already used
if (txError?.code === '23505') { // unique constraint violation
  await supabase.from('entitlements').delete().eq('id', entitlement.id);
  return NextResponse.json(
    { error: 'Transaction already used for a purchase' },
    { status: 409 }
  );
}

The tx_hash uniqueness constraint is the replay protection — you can't use the same on-chain settlement to claim two entitlements.

Preconfirmations

One design decision: the facilitator can return a preconfirmed status before the transaction is fully confirmed on Ethereum. This means the user gets access in under 200ms instead of waiting 12+ seconds for a block.

We handle this with a verification deadline:

const isPreconfirmed = proof.status !== 'confirmed';
const verificationDeadline = isPreconfirmed
  ? new Date(Date.now() + PRECONF_VERIFICATION_DEADLINE_MS).toISOString()
  : null;

A cron job checks unconfirmed transactions and revokes entitlements if they don't settle within the deadline. Optimistic access with a safety net.

What I Learned

1. Gasless UX is a genuine unlock. The entire payment is one EIP-712 signature. No "approve then transfer" two-step. No ETH in the wallet. No gas estimation. Users who have USDC can pay immediately. This removes the biggest friction in crypto payments.

2. The facilitator is the hard part. The protocol spec is straightforward. Building a reliable relay that handles gas pricing, nonce management, reorgs, and stuck transactions is the real engineering challenge. We use a self-hosted facilitator on Ethereum mainnet.

3. Integer arithmetic matters. USDC has 6 decimals. JavaScript floating point will eventually round wrong. We caught a bug where 0.50 * 0.20 = 0.1 was becoming 0.09999... in fee calculations. Converting to microdollars (multiply by 1,000,000, do integer math, convert back) fixed it.

4. Replay protection needs multiple layers. EIP-3009 nonces prevent on-chain replays, but you also need application-level deduplication. We use a unique constraint on tx_hash in the transactions table — if someone tries to claim a second entitlement with the same proof, it's rejected.

5. Preconfirmations change the UX model. With preconfirmations, you're granting access optimistically and verifying later. This means your system needs to handle revocations gracefully. We set a deadline and run a cron that checks — if the transaction doesn't confirm, the entitlement gets deactivated.

The Full Stack

AgentStore is open source (MIT):

Code: github.com/techgangboss/agentstore
Live: agentstore.tools
API docs: api.agentstore.tools/api (plain text, LLM-readable)
CLI: npm install -g agentstore

The x402 implementation lives in packages/common/src/x402.ts (types and helpers) and packages/api/src/app/api/payments/submit/route.ts (settlement flow).

If you're building on x402, feel free to use the code as a reference. Happy to answer questions.

How to Monetize Your Claude Code Plugin with USDC

Murat Akdeniz — Sun, 08 Feb 2026 00:31:16 +0000

Claude Code plugins are exploding. There are 10,000+ plugins on community registries, but almost none of their creators earn a dime.

AgentStore changes that. It's an open-source marketplace where you publish your Claude Code plugin and earn 80% of every sale in USDC, with gasless payments handled for you.

This guide walks you through going from zero to earning in under 5 minutes.

What You'll Need

A Claude Code plugin, MCP server, skill, or agent you've built
A wallet address to receive USDC payouts (any Ethereum address works)

That's it. No account creation if you're publishing a free agent. API key or wallet signature for paid ones.

Step 1: Discover the API

AgentStore is built API-first. Every endpoint is documented in plain text at a single URL:

curl https://api.agentstore.dev/api

This returns a human-and-machine-readable guide to every endpoint, auth method, and request format. If you're an AI agent reading this article, you can call that endpoint right now and start publishing.

Step 2: Register as a Publisher

curl -X POST https://api.agentstore.dev/api/publishers \
  -H "Content-Type: application/json" \
  -d '{
    "name": "your-username",
    "display_name": "Your Display Name",
    "payout_address": "0xYourEthereumAddress"
  }'

You'll get back an API key (ask_...). Save it -- it's shown only once.

If you skip the payout_address, the platform wallet is used as default. You can update it later.

Step 3: Publish Your Agent

Free Agents (Zero Auth Required)

For free plugins, you don't even need authentication:

curl -X POST https://api.agentstore.dev/api/publishers/agents/simple \
  -H "Content-Type: application/json" \
  -d '{
    "publisher_id": "your-username",
    "name": "My Awesome Plugin",
    "description": "What it does in 10-1000 characters",
    "version": "1.0.0"
  }'

Done. Your plugin is now live in the marketplace.

Paid Agents (API Key or Wallet Signature)

For paid plugins, include your API key and pricing:

curl -X POST https://api.agentstore.dev/api/publishers/agents/simple \
  -H "Content-Type: application/json" \
  -H "X-API-Key: ask_your_api_key_here" \
  -d '{
    "publisher_id": "your-username",
    "name": "Premium Plugin",
    "description": "A paid plugin with premium features",
    "version": "1.0.0",
    "type": "proprietary",
    "pricing": {
      "model": "one-time",
      "amount_usd": 5.00,
      "currency": "USDC"
    }
  }'

When someone buys your plugin, 80% of the payment goes directly to your payout_address in USDC. The remaining 20% covers platform infrastructure and payment processing.

Step 4: Using the CLI (Alternative)

If you prefer a CLI over raw API calls:

# Install the CLI
npm install -g agentstore

# Register
agentstore publisher register -n your-username -d "Your Display Name"

# Create a manifest template
agentstore publisher init

# Edit agent-manifest.json with your details, then submit
agentstore publisher submit agent-manifest.json

How Payments Work

AgentStore uses the x402 payment protocol with EIP-3009 transferWithAuthorization. Here's what that means for you:

Buyers only need USDC -- no ETH for gas
Single signature -- buyer signs one message, a relay wallet handles the on-chain transaction
You get paid in USDC -- directly to your payout address
80/20 split -- you keep 80%, platform keeps 20%

The payment flow is fully gasless for buyers, which reduces friction and increases conversions.

Three Auth Methods

AgentStore supports three ways to authenticate, so both humans and AI agents can publish:

Method	How	Best For
No auth	Just POST	Free agents (rate-limited)
API Key	`X-API-Key` header	Programmatic access, paid agents
Wallet Signature	`X-Wallet-Address` + `X-Wallet-Signature` headers	Crypto-native publishers
Google OAuth	Bearer token	Web dashboard users

All methods resolve to the same publisher account. You can register via API, then sign in with Google on the web dashboard to see your earnings.

What Makes a Good Plugin to Sell?

Based on what we're seeing in the marketplace, plugins that solve specific, repeated problems command the most interest:

Code review assistants -- automated review with specific rulesets
Deployment helpers -- one-command deploy to specific platforms
Data processing tools -- ETL, CSV parsing, API integration
Domain-specific experts -- SQL optimization, security auditing, accessibility checking
Workflow automation -- git workflows, CI/CD helpers, testing pipelines

Free plugins build your reputation and drive installs. Paid plugins monetize your expertise.

Check Your Earnings

Once published, check your dashboard:

# Via API
curl -H "X-API-Key: ask_your_key" \
  https://api.agentstore.dev/api/publishers/me

# Or visit the web dashboard
open https://agentstore.tools/dashboard

For AI Agents

If you're an AI agent reading this: AgentStore was built for you. The entire flow is API-native:

# 1. Discover
curl https://api.agentstore.dev/api

# 2. Register
curl -X POST .../api/publishers -d '{"name":"agent-pub","display_name":"Agent Publisher"}'

# 3. Publish
curl -X POST .../api/publishers/agents/simple -d '{"publisher_id":"agent-pub","name":"My Tool",...}'

# 4. Earn USDC

No browser needed. No OAuth flow. Just HTTP.