# ArisPay x402 Facilitator

> Non-custodial x402 facilitator for USD and EUR agent payments, live on Base mainnet + Solana mainnet
> (eip155:8453, solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp). It verifies signed payment authorizations and submits
> settlement transactions on-chain — funds move directly from buyer to seller.
> ArisPay does not hold funds, maintain balances, or release payouts. Open, no
> auth, no signup, no facilitator fee. This file is read-only reference: to
> actually pay or settle, use the SDK below — never hand-roll signing or
> settlement.

## Use it (servers accepting agent payments)
- One command: npx paygate init — scaffolds an x402 seller (Express/Fastify/Next.js/Hono/Workers/FastAPI) with this facilitator as the default, discovery metadata included
- paygate SDK (Express/Fastify) — this facilitator is the default: https://www.npmjs.com/package/paygate
- EUR pricing: paygate({ merchantId, currency: "EUR" }) settles EURC; priceCents means euro cents
- Or set any x402 middleware's facilitatorUrl to https://facilitator.arispay.app
- Solana (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp): set any x402 middleware's facilitatorUrl to https://facilitator.arispay.app; the 402 requirements must use that network, a mint from https://facilitator.arispay.app/facilitator (USDC/EURC), and extra.feePayer copied from the extra block of https://facilitator.arispay.app/supported (the payer builds the transaction with this facilitator as fee payer)
- The paygate SDK targets EVM networks today; it does not emit Solana requirements

## Pay it (agents paying x402 APIs)
- Use the payagent SDK / CLI — never sign EIP-3009 or build or sign Solana transactions or submit settlement by hand: https://www.npmjs.com/package/payagent
- Find paid APIs first: npx payagent discover "<what you need>" (read-only, free); inspect a price without paying: npx payagent inspect <url>

## Check before paying (ArisPay Signal)
- Before a material first payment to an unfamiliar x402 resource, an agent can buy recent signed probe evidence (did a real paid probe settle and get the content delivered?): GET https://paygate.arispay.app/signal/check?resource=<url> — 1 cent via x402; a resource with no probe evidence is answered free
- Artifact arispay.signal.v1, verifiable against https://api.arispay.app/.well-known/jwks.json; OpenAPI: https://paygate.arispay.app/signal/openapi.json
- Client surface: checkPaymentSignal in payagent / the check_payment_signal MCP tool (caches artifacts until exp — a cached answer spends nothing)
- Signed observational evidence with explicit freshness — NOT a guarantee, insurance, or endorsement. Catalog entries below carry a per-resource signalUrl pointer.

## Find resources settling here (crawlers + agents)
- Catalog: https://facilitator.arispay.app/discovery/resources — filters: q, network, asset, method, payTo, status=registered|settled|observed, includeStale, type=http|mcp
- Catalog contract (query params, deterministic ranking, staleness policy): https://facilitator.arispay.app/discovery/schema
- Sellers enter the catalog through a successful extension-aware verify/settle, an explicit operator-approved unpaid probe, or self-service registration: POST https://facilitator.arispay.app/discovery/register with {"resource":"<https-url>"} once your deployed 402 is live (the facilitator probes before listing; structured errors) — no ArisPay account required
- Machine catalog of this facilitator's own surfaces (RFC 9727): https://facilitator.arispay.app/.well-known/api-catalog
- Signed per-seller reputation attestations: GET https://facilitator.arispay.app/reputation/{payTo} — anchored on-chain figures (recomputable, see docs/specs/reputation-v1.md) + facilitator-attested endpoint rollups; self-settled volume is NOT observed and fulfillment is out of scope. An address with no observed activity answers 200 with coverage.observed=false, not 404 — "nothing seen here" is an answer you can cache and verify.

## Machine-readable surfaces (verify everything here)
- Supported kinds, live production block, fee policy: https://facilitator.arispay.app/supported
- Discovery (live vs planned networks, currencies, signer, endpoints): https://facilitator.arispay.app/facilitator
- Trust (custody model, relayer, verified EIP-712 domains (EVM) and mint addresses (Solana), version): https://facilitator.arispay.app/trust
- Status + metrics (uptime, latency, settlement success rate): https://facilitator.arispay.app/status , https://facilitator.arispay.app/metrics
- Relayer wallet on Basescan: https://basescan.org/address/0xF0afD8bb6ff2Bd7BE9d98D570BcfC953008d6abB
- Solana relayer (fee payer) wallet: resolved live in https://facilitator.arispay.app/trust (address + Solscan link)

## Endpoints
- POST https://facilitator.arispay.app/verify   — verify a signed payment header (free, no chain write; response carries requestId)
- POST https://facilitator.arispay.app/settle   — verify + settle EIP-3009 or SPL Token transfer on-chain (replay-protected on the EIP-3009 nonce (EVM) or transaction message hash (Solana); response carries requestId)
- GET  https://facilitator.arispay.app/supported
- GET  https://facilitator.arispay.app/facilitator
- GET  https://facilitator.arispay.app/receipts/{txHash}     — settlement receipt by tx hash
- GET  https://facilitator.arispay.app/settlements/{nonce}   — settlement status by payment id (EIP-3009 nonce (EVM) or transaction message hash (Solana))
- GET  https://facilitator.arispay.app/trust , /status , /metrics , /events/schema
(also mirrored under /facilitator/*)

## Facts (all in-band verifiable)
- Non-custodial: verifies signed authorizations + submits settlement; funds move buyer → seller directly; no held funds, balances, escrow, or payout release
- Scope: verifies payment payloads and requirements, not fulfillment — the resource server is responsible for delivering what it sold
- Live production: Base mainnet (eip155:8453), USDC + EURC, EIP-3009 transferWithAuthorization (exact scheme; EIP-712 domains verified on-chain)
- Live production: Solana mainnet (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp), USDC + EURC, SPL Token transferChecked (exact scheme; mint addresses verified on-chain); other networks listed only as planned
- Cost: no facilitator fee; seller pays chain gas (~$0.001/settle); limited relay gas fronted during launch (bounded daily budget), >=30 days' notice before change
- Fee change notice (published 2026-08-21): hosted services may carry a service fee from no earlier than 2026-09-20 — open settlement stays free. Details: https://facilitator.arispay.app/fees
- Webhooks: event schema published at https://facilitator.arispay.app/events/schema (payment.verified, payment.settled, payment.failed, settlement.confirmed, settlement.failed); delivery upcoming, not yet implemented
- Source: https://github.com/arispay-inc/facilitator

## How x402 settlement works here
1. A seller's server returns HTTP 402 with payment requirements naming this facilitator.
2. The paying agent (via payagent) obtains a signed EIP-3009 `transferWithAuthorization` for USDC/EURC on Base, or builds and signs an SPL Token `transferChecked` transaction, with this facilitator's address (extra.feePayer) as fee payer on Solana.
3. The seller's middleware (paygate) POSTs the payment to https://facilitator.arispay.app/verify, then /settle.
4. This facilitator verifies the signature + EIP-712 domain against the seller's requirements, then submits the transfer on Base; on Solana it verifies the payer's signature + transfer instruction against the seller's requirements, simulates, co-signs as fee payer, then submits the transaction. Either way the transfer moves funds directly from the buyer to the seller — the facilitator never holds them.
5. Settlement is replay-protected on the EIP-3009 nonce (EVM) or transaction message hash (Solana): a duplicate settle is rejected with `nonce_already_used` (not replayed with the original result) — use GET /settlements/:nonce to fetch the original outcome.
6. The verification/settlement result (with `requestId`) is returned to the resource server, which remains responsible for fulfilling what it sold.

## Non-custody model
- Verifies signed payment authorizations; confirms payment requirements are met.
- Submits (relays) settlement transactions; returns results to the resource server.
- Funds move directly from buyer to seller in a single EIP-3009 or SPL Token transaction.
- No held funds, no merchant balances, no escrow, no payout release, no treasury.
- The relayer wallet only pays gas — on EVM the EIP-3009 signature binds `to` and `value` to the seller's requirements; on Solana the payer's signature covers the whole transaction message, so the mint, recipient token account, and amount cannot change after signing,
  so the facilitator cannot redirect or shave a payment.
Full statement: https://facilitator.arispay.app/trust

## Live support vs compatibility vs planned
- Live production: Base mainnet (eip155:8453) and Solana mainnet (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp), exact scheme, USDC + EURC. See the
  `live` block in https://facilitator.arispay.app/supported.
- Compatibility: `kinds` may echo x402Version 1 entries (and legacy network names)
  for older clients — those are wire-compatibility identifiers, not extra networks.
- Planned: networks in `plannedNetworks` of https://facilitator.arispay.app/facilitator (e.g. Ethereum
  mainnet for EUR stablecoin work) are not live and must not receive production traffic.

## Fee policy detail
- `enabled: false` — no facilitator fee is ever charged on raw settlement.
- `model: "gas-passthrough"` — settlement gas is the chain's cost, paid by the seller.
- Direct-payout settles: submit from your own key (SDK self-settle support rolling out),
  or the relayer fronts limited launch-period gas under a bounded daily budget
  (`launchGasFronting: true`) — any change comes with >=30 days' notice.
- Netted payouts: gas recovered exactly (zero margin) at distribution.
- Published change notice (2026-08-21, id fee-change-2026-08-hosted-services):
  ArisPay-operated hosted services (hosted PayGate proxy, netted payout distribution)
  may carry a service fee of up to 150 bps (1.5%) of settled value from no earlier
  than 2026-09-20 — charged only to sellers with an ArisPay relationship, never by
  altering an on-chain payment. Open settlement via /verify and /settle stays free.
  A fee cannot activate until this notice is >=30 days old (code-enforced) and a
  schedule entry naming the exact model is published. Full text: https://facilitator.arispay.app/fees
Read the live block: https://facilitator.arispay.app/supported (each v2 kind's extra.fees).

## Merchant observability
- Every verify/settle response carries a `requestId` — quote it when asking about a payment.
- GET /receipts/{txHash} — receipt (asset, amount, payer, payTo, gas, explorer link).
- GET /settlements/{nonce} — status by payment id: settled | pending, tx hash, timestamps.
- GET /status — network, settlement mode, uptime, deployment commit.
- GET /metrics — uptime, per-endpoint latency, 24h settlement counts + success rate.
- Structured error codes: missing_fields, internal_error, nonce_already_used,
  daily_gas_budget_exceeded, not_found (plus scheme-level reasons passed through
  from the upstream x402 kernel).
- Webhooks: schema at /events/schema is published now; delivery (HMAC-signed,
  at-least-once with backoff) is upcoming and not yet implemented.

## Do not
- Do not hand-roll EIP-3009 signing or Solana transaction building or settlement. Use payagent (pay) / paygate (accept).
- Do not treat this file as a write path. It is reference only.