The facilitator branch is where the keyless claim actually gets tested. The config picks `createFacilitatorConfig(config.cdpApiKeyId, config.cdpApiKeySecret)` when `config.isMainnet`, and a bare `{ url: config.testnetFacilitatorUrl }` otherwise, with an inline comment noting that the testnet URL needs no key [5]. Buyers turn up with a wallet address and nothing else [3]. Sellers on mainnet keep a Coinbase CDP credential and a third party inside the request path [5]. The account relationship has not gone away; it sits between the seller and the facilitator instead of between the seller and the caller.
On a call, `paymentMiddleware` answers the paid route with 402 and the requirements, the `@x402/fetch` wrapper signs and replays, and `@x402/express` calls the facilitator's verify and settle before the handler runs [2][12][6]. The route table names the chain in CAIP-2 form, `eip155:8453` on mainnet [7]. That is two requests to your server for one resource, plus a verify and an on-chain settle you do not control [17]. The handler stays clean: it sees `req` and `res`, never an address or a signature [6], and the gas endpoint's body is a `viem` read against a public RPC [8]. Payment as middleware, business logic that does not know it is being sold, is the good engineering in this build.
Pricing is where I would push back. `export const price = "$0.005"` lives in the endpoint module next to the handler [8][4], so a repricing is a code change and a deploy. At half a cent, a dollar buys 200 calls [15]. The gas read is wrapped in `cached("gas-base", 60_000, ...)` [9], so a client polling once a second pays $0.30 a minute while the server makes at most one upstream RPC call in that minute [16]. Nothing in the declared schema lets a caller ask for a fresh read: `inputSchema` is `{ properties: {}, required: [] }` [10]. Cache TTL is now a pricing decision. The buyer cannot see it.
A couple of things are worth checking before copying this. All five `@x402/*` packages are pinned at 2.24.0 with `@coinbase/x402` at 2.1.0, and the older unscoped `x402-express` and `x402-fetch` are deprecated and must not be mixed with the scoped v2 line [11]. A protocol shipping under two namespaces at once will earn its share of confused stack traces. Second, the buyer's identity is `privateKeyToAccount(BUYER_PRIVATE_KEY)` [12], so the thing that names your client and the thing that spends its money are one secret in one process.
For a machine client that wants a single read from a server it has never met, this is a better deal than key issuance, and the receipt comes back in a header you decode to a transaction [13]. For anything with a customer relationship, the account you skipped creating is the one you will want the first time a paid call settles and then returns a 500. The author frames the piece as a code and protocol tour rather than an agentic economy pitch [14], and it holds up read on those terms.
