One dollar, one signature, one key.

curl -s https://xytara.onrender.com/v1/credits/balance \
  -H "Authorization: Bearer YOUR_KEY"
# -> {"ok":true,"account_id":"0x...","available_units":400,"credits_per_call":3,...}

// Buy 400 credits ($1.00 USDC on Base mainnet) from a wallet key and print the spend key.
// Node 20+. npm i viem@2.21.55   (BUYER_PRIVATE_KEY holds USDC on Base; no ETH is needed, the facilitator pays gas)
import { privateKeyToAccount } from "viem/accounts";
import { randomBytes } from "node:crypto";

const TOPUP = "https://xytara.onrender.com/x402/credits/topup";
const account = privateKeyToAccount(process.env.BUYER_PRIVATE_KEY);

// 1. Unpaid POST -> 402 with the exact terms (network, asset, amount, payTo).
const quote = await fetch(TOPUP, { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
if (quote.status !== 402) throw new Error("expected 402, got " + quote.status + " " + (await quote.text()));
const { payment_required } = await quote.json();
const accept = payment_required.accepts.find((a) => a.network === "eip155:8453" && a.scheme === "exact");

// 2. Sign one gasless USDC authorization (EIP-3009 TransferWithAuthorization, EIP-712).
const now = Math.floor(Date.now() / 1000);
const authorization = {
  from: account.address,
  to: accept.payTo,
  value: accept.amount,
  validAfter: "0",
  validBefore: String(now + (accept.maxTimeoutSeconds || 300) - 30),
  nonce: "0x" + randomBytes(32).toString("hex")
};
const signature = await account.signTypedData({
  domain: { name: accept.extra.name, version: accept.extra.version, chainId: 8453, verifyingContract: accept.asset },
  types: {
    TransferWithAuthorization: [
      { name: "from", type: "address" }, { name: "to", type: "address" }, { name: "value", type: "uint256" },
      { name: "validAfter", type: "uint256" }, { name: "validBefore", type: "uint256" }, { name: "nonce", type: "bytes32" }
    ]
  },
  primaryType: "TransferWithAuthorization",
  message: { ...authorization, value: BigInt(authorization.value), validAfter: 0n, validBefore: BigInt(authorization.validBefore) }
});
const paymentSignature = Buffer.from(JSON.stringify({ x402Version: 2, accepted: accept, payload: { signature, authorization } })).toString("base64");

// 3. Paid POST -> 200 with the spend key (shown once) and the credit grant.
const paid = await fetch(TOPUP, { method: "POST", headers: { "content-type": "application/json", "PAYMENT-SIGNATURE": paymentSignature }, body: "{}" });
const result = await paid.json();
if (!paid.ok) throw new Error(paid.status + " " + result.reason + (result.detail ? ": " + result.detail : ""));
console.log("spend key (shown once, keep it secret):", result.spend_credential.bearer_token);
console.log("credits available:", result.balance.available_units);