# x402 on sats.4nkweb.com

## Live
- Health: GET /api/health
- Catalog: GET /api/x402/catalog or /.well-known/x402
- Paid: GET /api/x402/btc-pulse ($0.01 USDC Base)
- Paid: POST /api/x402/echo ($0.01 USDC Base)
- Free SatPack: POST /api/run

## Security
- payTo locked server-side (public address only; no private key on server)
- Facilitator allowlisted: https://facilitator.payai.network
- Mainnet Base USDC only (no testnet)
- Rate limit 30 req/min/IP
- Replay cache of settled payment fingerprints
- Body size cap 64 KiB
- Requirements amount/resource/payTo not client-controllable

## Client flow
1. GET paid route → HTTP 402 + PAYMENT-REQUIRED
2. Sign X-PAYMENT / PAYMENT-SIGNATURE via x402 buyer SDK
3. Retry → verify+settle via PayAI → 200 + body