What is x402 Payment Verification?
x402 payment verification is the process by which a resource server (or its facilitator) confirms that a client's signed payment payload is valid — checking cryptographic signatures, sufficient token balances, correct amounts, nonce freshness, and authorisation expiry — before serving the requested resource.
WHY IT MATTERS
Verification is the critical security step in the x402 flow. When a client sends a request with a PAYMENT-SIGNATURE header, the resource server needs to confirm the payment is legitimate before doing any work.
For the exact scheme on EVM chains, verification includes:
- Signature validity — the EIP-3009
transferWithAuthorizationsignature is cryptographically valid and was produced by the claimed signer - Amount match — the authorised amount matches the payment requirement
- Recipient match — the authorised recipient matches the server's specified payment address
- Nonce freshness — the nonce hasn't been used before (prevents replay attacks)
- Expiry check — the authorisation hasn't expired
- Balance check — the signer has sufficient token balance to cover the payment
Resource servers can verify locally (if they have chain access) or delegate to a facilitator's /verify endpoint. The facilitator returns a structured VerificationResponse indicating whether the payment is valid.
This verify-first approach means the server never does expensive work (API calls, inference, data retrieval) for invalid payments. It also ensures on-chain settlement will succeed when called later — the pre-signed authorisation is guaranteed executable if verification passes.
HOW POLICYLAYER USES THIS
PolicyLayer adds a policy verification layer on top of the protocol's payment verification. Even if a payment payload is cryptographically valid, PolicyLayer checks whether the payment should be made — enforcing budgets, recipient allowlists, rate limits, and domain pinning rules that the protocol itself doesn't enforce.