aws-samples / aws-samples/sample-agentic-serverless-payments

Potential x402 header mismatch in agentic seller 402 response

Open
#36 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
9
Forks
4
PR merge metrics
No merged PRs in 30d

Description

Hi, I noticed a possible x402 transport mismatch in the agentic seller Lambda.

In `agentic/lambda/seller.js`, the `/generate_image` middleware checks for `PAYMENT-SIGNATURE` first, with `X-PAYMENT` as a legacy fallback:

https://github.com/aws-samples/sample-agentic-serverless-payments/blob/f067a6cd4c9340b8c28e11c19db79e75f8272ce2/agentic/lambda/seller.js#L184-L185

When no payment header is present, it builds a response with `x402Version: 1` and returns it as a JSON `402` body:

https://github.com/aws-samples/sample-agentic-serverless-payments/blob/f067a6cd4c9340b8c28e11c19db79e75f8272ce2/agentic/lambda/seller.js#L206-L213

However, unlike the serverless seller implementation, this response does not set a `PAYMENT-REQUIRED` response header:

https://github.com/aws-samples/sample-agentic-serverless-payments/blob/f067a6cd4c9340b8c28e11c19db79e75f8272ce2/serverless/lambda/seller/seller.js#L296-L298

This seems potentially inconsistent with the rest of the agentic flow and docs, which describe the x402 client receiving the `402`, signing, and retrying with `PAYMENT-SIGNATURE`:

https://github.com/aws-samples/sample-agentic-serverless-payments/blob/f067a6cd4c9340b8c28e11c19db79e75f8272ce2/README.md#L76-L82

If the x402 client expects payment requirements from the `PAYMENT-REQUIRED` response header, it may not be able to automatically handle the `402` response from the agentic endpoint.

Should the agentic `/generate_image` `402` response also set `PAYMENT-REQUIRED`, similar to the serverless implementation?

```js
c.header('PAYMENT-REQUIRED', Buffer.from(JSON.stringify(paymentRequirements)).toString('base64'));
return c.json(paymentRequirements, 402);
```

Or is the agentic path intentionally pinned to a body-based x402 v1 client contract?

I have not tested this against a live deployment; this is based on the current `main` branch source.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.