Two endpoints do the
work. Verify, then
settle.

# pip install fastapi uvicorn httpx
import base64, json, os
import httpx
from fastapi import FastAPI, Request
from fastapi.responses import JSONResponse

FACILITATOR = "https://402.wick.pics"
TOKEN       = os.environ["QWICKPAY_MERCHANT_TOKEN"]   # from POST /bundles
PAY_TO      = "0xYourMerchantAddress"
ASSET       = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"  # USDC on Base

app = FastAPI()


def requirements(price_atomic: str) -> dict:
    # x402 v1 PaymentRequirements. 'resource' is signed over by the payer,
    # so it MUST be the exact URL they were told to pay.
    return {
        "scheme": "exact",
        "network": "base",                # v1 name; v2 uses "eip155:8453"
        "maxAmountRequired": price_atomic,   # atomic units. 6 dp => "410000" = $0.41
        "asset": ASSET,
        "payTo": PAY_TO,
        "resource": "https://your.api/gpu/hour",
        "description": "1 hour of rtx4090 time. No refunds; charged after delivery.",
        "mimeType": "application/json",
        "outputSchema": None,
        "maxTimeoutSeconds": 120,
        "extra": {"name": "USD Coin", "version": "2"},
    }


def envelope(payload: dict, reqs: dict) -> dict:
    # The one shape /verify and /settle both take.
    return {"x402Version": payload.get("x402Version", 1),
            "paymentPayload": payload,
            "paymentRequirements": reqs}


def facilitator(path: str, body: dict, *, token: str = "") -> dict:
    headers = {"Content-Type": "application/json"}
    if token:
        headers["X-Merchant-Token"] = token      # /settle only. Never log it.
    r = httpx.post(f"{FACILITATOR}{path}", json=body, headers=headers, timeout=150)
    r.raise_for_status()
    return r.json()


@app.post("/gpu/hour")
async def rent(request: Request):
    reqs  = requirements("410000")
    header = request.headers.get("x-payment", "")

    # ---- 1. no payment yet: quote the price and stop.
    if not header:
        return JSONResponse(status_code=402, content={
            "x402Version": 1,
            "error": "X-PAYMENT header is required",
            "accepts": [reqs],
        })

    payload = json.loads(base64.b64decode(header))

    # ---- 2. verify. Nothing moves on-chain. Free.
    v = facilitator("/verify", envelope(payload, reqs))
    if not v.get("isValid"):
        return JSONResponse(status_code=402, content={
            "error": "payment_invalid",
            "reason": v.get("invalidReason"),
            "accepts": [reqs],
        })

    # ---- 3. DO THE WORK HERE, before any money moves.
    result = start_the_lease()          # yours. If it raises, nothing was charged.

    # ---- 4. settle. This is the metered call.
    s = facilitator("/settle", envelope(payload, reqs), token=TOKEN)
    if not s.get("success"):
        tear_down(result)               # do not run what you could not charge for
        return JSONResponse(status_code=402, content={
            "error": "settlement_failed", "reason": s.get("errorReason")})

    return JSONResponse(
        content={"ok": True, "tx": s.get("transaction"), "result": result},
        headers={"X-PAYMENT-RESPONSE": base64.b64encode(
            json.dumps(s).encode()).decode()},
    )

# stdlib + eth_account. No web3, no node, no RPC.
pip install eth-account

# 1. Look before you sign. --dry-run stops after printing the price
#    and the fee disclosure. Do this first against any new server.
python3 x402-client.py --url https://your.api/gpu/hour --dry-run

# 2. Pay for real. The key never leaves the process; prefer the env var.
export X402_CLIENT_KEY=0x<payer private key>
python3 x402-client.py \
  --url https://your.api/gpu/hour \
  --blocks 1 \
  --ssh-pubkey "$(cat ~/.ssh/id_ed25519.pub)"

# --key 0x...          payer key inline (env X402_CLIENT_KEY is safer)
# --url URL            the 402-protected resource (env X402_URL)
# --ssh-pubkey KEY     passed to the merchant; how a GPU rental lets you in
# --x402-version 1|2   which envelope to sign
# --dry-run            print the challenge, sign nothing, spend nothing

# ---- 1. ask without paying. You get the price, signed-over, in one object.
curl -s -X POST https://your.api/gpu/hour -H 'Content-Type: application/json' -d '{}'

# HTTP/1.1 402 Payment Required
# {
#   "x402Version": 1,
#   "error": "X-PAYMENT header is required",
#   "accepts": [{
#     "scheme": "exact",  "network": "base",
#     "maxAmountRequired": "410000",
#     "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
#     "payTo": "0x085cacDDd02fe32212DEEfFC858D197b31b80719",
#     "resource": "https://your.api/gpu/hour",
#     "description": "1 hour of rtx4090 time. Price $0.40 + fee $0.01 = $0.41",
#     "maxTimeoutSeconds": 120,
#     "extra": {"name": "USD Coin", "version": "2"}
#   }]
# }

# ---- 2. sign accepts[0] off-chain, then send the SAME request again
#         with the base64 payload in X-PAYMENT.
curl -s -X POST https://your.api/gpu/hour \
  -H 'Content-Type: application/json' \
  -H "X-PAYMENT: $(cat payload.json | base64 -w0)" \
  -d '{}'

# HTTP/1.1 200 OK
# X-PAYMENT-RESPONSE: eyJzdWNjZXNzIjp0cnVlLCJ0cmFuc2FjdGlvbiI6IjB4…
# {"ok": true, "tx": "0x9f2a…", "result": {…}}

# 1. the challenge — one chain, free, no token needed
curl -s -X POST https://402.wick.pics/echo/eip155:369 \
  -H 'Content-Type: application/json' -d '{}' | jq .

# 2. sign accepts[0], then send it back. Verify-only: nothing settles.
curl -s -X POST https://402.wick.pics/echo/eip155:369 \
  -H 'Content-Type: application/json' \
  -H "X-PAYMENT: $(base64 -w0 < payload.json)" \
  -d '{}' | jq .

# POST /echo with no chain lists the chains it will echo for.
# A v1 network alias works too where the chain has one: /echo/base
curl -s -X POST https://402.wick.pics/echo | jq '.chains'

# and the two calls that need nothing at all:
curl -s https://402.wick.pics/health   | jq .
curl -s https://402.wick.pics/supported | jq '.kinds, .signers'