x402 Security Best Practicesx402 security checklist: server-side verification, replay protection, amount checks, refund policy, and logging every paid request.FAQ

What is the biggest x402 security mistake?

Serving content on an unverified proof. Always confirm through the facilitator first.

What is a replay attack?

Reusing one payment proof for many downloads. Bind proofs to single uses or short windows.

Should I check the destination wallet?

Yes. Confirm funds went to your address, or an attacker can pay themselves and show you the receipt.

Do quotes need expiry?

Yes. Without expiry, buyers can reuse old cheap quotes after you raise prices.

What belongs in the logs?

Quote details, payment proof reference, verification verdict, timestamp, and what was served.

How do refunds stay safe?

Refund only to the paying wallet, only for failed deliveries, and record every refund next to its log entry.

All tools · Sitemap · Games