What is x402 Domain Pinning?
x402 domain pinning (also called recipient pinning) is a security control that associates specific payment recipient addresses with specific domains — blocking payments when an x402 endpoint suddenly requests payment to a different address than previously observed, indicating potential compromise or attack.
WHY IT MATTERS
One of the critical x402 threat models is payment redirection. A legitimate API at api.example.com normally requests payment to address 0xABC.... If the domain is compromised (DNS hijacking, server breach, man-in-the-middle), an attacker could serve 402 responses directing payments to their own address 0xEVIL....
Without domain pinning, an agent blindly pays whoever the 402 response specifies. The agent has no way to know the recipient address changed — it just sees a valid 402 response and pays.
Domain pinning works by recording the first observed recipient address for each domain and flagging or blocking subsequent requests to different addresses:
- Agent first visits
api.example.com→ receives 402 requesting payment to0xABC... - PolicyLayer records the pin:
api.example.com → 0xABC... - Later, agent visits
api.example.com→ receives 402 requesting payment to0xEVIL... - PolicyLayer detects the mismatch → payment blocked, operator notified
This is analogous to SSH host key verification or HTTP Public Key Pinning (HPKP) — trust on first use, then verify consistency. Operators can also pre-configure pins for known vendors, establishing trust before the first interaction.
Domain pinning is particularly important because x402 payments are irreversible. A misdirected credit card payment can be charged back. A misdirected USDC transfer on Base is gone.
HOW POLICYLAYER USES THIS
PolicyLayer's recipient pinning feature is a core part of x402 policy enforcement. Pins are automatically created on first contact with new endpoints and can be pre-configured for known vendors. Any payment to an unpinned or mismatched address is blocked, with webhook notifications for operator review.