aws-samples / aws-samples/sample-agentic-serverless-payments
Potential x402 header mismatch in agentic seller 402 response
- Dominant language
- TypeScript
- Stars
- 9
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
Hi, I noticed a possible x402 transport mismatch in the agentic seller Lambda.
In `agentic/lambda/seller.js`, the `/generate_image` middleware checks for `PAYMENT-SIGNATURE` first, with `X-PAYMENT` as a legacy fallback:
https://github.com/aws-samples/sample-agentic-serverless-payments/blob/f067a6cd4c9340b8c28e11c19db79e75f8272ce2/agentic/lambda/seller.js#L184-L185
When no payment header is present, it builds a response with `x402Version: 1` and returns it as a JSON `402` body:
https://github.com/aws-samples/sample-agentic-serverless-payments/blob/f067a6cd4c9340b8c28e11c19db79e75f8272ce2/agentic/lambda/seller.js#L206-L213
However, unlike the serverless seller implementation, this response does not set a `PAYMENT-REQUIRED` response header:
https://github.com/aws-samples/sample-agentic-serverless-payments/blob/f067a6cd4c9340b8c28e11c19db79e75f8272ce2/serverless/lambda/seller/seller.js#L296-L298
This seems potentially inconsistent with the rest of the agentic flow and docs, which describe the x402 client receiving the `402`, signing, and retrying with `PAYMENT-SIGNATURE`:
https://github.com/aws-samples/sample-agentic-serverless-payments/blob/f067a6cd4c9340b8c28e11c19db79e75f8272ce2/README.md#L76-L82
If the x402 client expects payment requirements from the `PAYMENT-REQUIRED` response header, it may not be able to automatically handle the `402` response from the agentic endpoint.
Should the agentic `/generate_image` `402` response also set `PAYMENT-REQUIRED`, similar to the serverless implementation?
```js
c.header('PAYMENT-REQUIRED', Buffer.from(JSON.stringify(paymentRequirements)).toString('base64'));
return c.json(paymentRequirements, 402);
```
Or is the agentic path intentionally pinned to a body-based x402 v1 client contract?
I have not tested this against a live deployment; this is based on the current `main` branch source.
Contributor guide
Assessment
This issue has not been assessed yet.