feat(cloudfront-lambda-edge): Add CDP facilitator authentication and …

[arditti]

Description

Adds CDP facilitator authentication support to the CloudFront + Lambda@Edge example, enabling mainnet payments.

Key changes:

New facilitator-auth.ts with createCDPAuthHeaders() for CDP JWT authentication
Updated config.ts with facilitator type selection (x402.org, cdp, custom)
Added @coinbase/cdp-sdk dependency for JWT generation
Improved README with mainnet setup instructions and secrets management guidance
Included AWS Secrets Manager integration pattern for production deployments
This builds on PR #980 and allows users to accept real USDC payments on Base mainnet using the CDP facilitator.

Tests
This is an example/reference implementation. Verified by:

TypeScript compilation passes (tsc --noEmit)
ESBuild bundling works (npm run build in lambda/ directory)
From /examples/typescript directory: pnpm format && pnpm lint
Checklist
[x] I have formatted and linted my code
[x] All new and existing tests pass
[x] My commits are signed (required for merge)
[] I added a changelog fragment for user-facing changes (docs-only changes can skip)

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[vercel]

@arditti is attempting to deploy a commit to the Coinbase Team on Vercel.

A member of the Team first needs to authorize it.

[phdargen]

Thanks a lot for the update @arditti!

This one is a bit tricky, we deliberately removed all mainnet examples (in particular anything CDP specific) from the repo for neutrality.

For TS we have a CDP package that handles all the API key and auth header stuff, such that users just have to replace one line
const facilitatorClient = new HTTPFacilitatorClient({ url: facilitatorUrl });
with:

import { facilitator } from "@coinbase/x402";
const facilitatorClient = new HTTPFacilitatorClient(facilitator);

see https://docs.cdp.coinbase.com/x402/quickstart-for-sellers#running-on-mainnet

Would this work here?
Otherwise, we would need to remove all the CDP specific language like createCDPAuthHeaders -> createAuthHeaders etc and make the API key/auth setup sufficiently general

[arditti]

Thanks a lot for the update @arditti!

This one is a bit tricky, we deliberately removed all mainnet examples (in particular anything CDP specific) from the repo for neutrality.

For TS we have a CDP package that handles all the API key and auth header stuff, such that users just have to replace one line const facilitatorClient = new HTTPFacilitatorClient({ url: facilitatorUrl }); with:

import { facilitator } from "@coinbase/x402";
const facilitatorClient = new HTTPFacilitatorClient(facilitator);

see https://docs.cdp.coinbase.com/x402/quickstart-for-sellers#running-on-mainnet

Would this work here? Otherwise, we would need to remove all the CDP specific language like createCDPAuthHeaders -> createAuthHeaders etc and make the API key/auth setup sufficiently general

Thanks @phdargen, great point about neutrality.

I've reworked the PR - removed all CDP-specific code (facilitator-auth.ts, @coinbase/cdp-sdk dep, the CDP credentials/auth logic in config.ts). The source files are now back to testnet-only, same as the rest of the repo.

For mainnet, the server.ts now accepts an optional facilitatorConfig (a FacilitatorConfig object with url + createAuthHeaders) so users can plug in any facilitator that requires auth - without modifying anything under lib/. The README's "Running on Mainnet" section points to the ecosystem facilitators page and shows the generic pattern.

I looked into the @coinbase/x402 package and createFacilitatorConfig does accept explicit key params, which works nicely for Lambda@Edge since it doesn't support env vars. But I kept that out of the source code per your feedback - it's just documented as the pattern in the README.

[phdargen]

Perfect, thanks @arditti!