feat: add P402 as Facilitator

[Z333Q]

Description

Tests

Checklist

• I have formatted and linted my code
• All new and existing tests pass
• My commits are signed (required for merge) -- you may need to rebase if you initially pushed unsigned commits

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[vercel]

@Z333Q is attempting to deploy a commit to the Coinbase Team on Vercel.

A member of the Team first needs to authorize it.

[phdargen]

Hi @Z333Q, thanks for your submission!

• please verify all your commits
• files are in the wrong location, should go in typescript/site
• are you sure facilitators is the correct category for your project? From your website it appears its primarily a client sdk? Please provide a valid facilitator url with working /supported endpoint

[Z333Q]

Thanks @phdargen! I have addressed all feedback:
File Locations: Fixed. metadata.json and the logo are now in typescript/site/app/....
Signature Verification: I have rebased and signed the commits.
Facilitator Category: Validated. We verify and settle logic on-chain (Base).
Verify Endpoint: https://www.p402.io/api/v1/facilitator/verify
Settle Endpoint: https://www.p402.io/api/v1/facilitator/settle

[Must-be-Ash]

Hi there! All commits must have verified signatures.

[Z333Q]

verify commit

[Must-be-Ash]

Also /supported is still returning '404' and I tested the facilitator with an endpoint and it returned HTTP 200 but:

• Uses ok field instead of success (x402 spec requires success: boolean)
• Missing transaction field (required - must contain blockchain transaction hash)
• Missing network field (required - must identify the blockchain network)
• txHash is null, indicating no actual blockchain transaction occurred
• Response explicitly indicates "demo mode" - not suitable for production

[Must-be-Ash]

3c57c8c, a970adc, and 29f9b0b are still not signed

[Must-be-Ash]

@Z333Q
fix: move assets to typescript/site and cleanup root
a970adc

feat: add P402 as Facilitator
3c57c8c

[phdargen]

seems there is no discovery endpoint live, please set list to false

[Z333Q]

@phdargen done.
"list": false

[phdargen]

Hi @Z333Q, tested your facilitator with this example on base mainnet: https://github.com/coinbase/x402/tree/main/examples/typescript/servers/express
but getting error: 'Failed to verify payment: 400 Bad Request'

Also your supported endpoint shows 0x0000000000000000000000000000000000000000 as signer, please fill in your actual facilitator address

[Z333Q]

Hi @Z333Q, tested your facilitator with this example on base mainnet: https://github.com/coinbase/x402/tree/main/examples/typescript/servers/express but getting error: 'Failed to verify payment: 400 Bad Request'

Also your supported endpoint shows 0x0000000000000000000000000000000000000000 as signer, please fill in your actual facilitator address

Hi @phdargen, thanks for testing! Both issues have been fixed:

1. Signer address on /supported
   The endpoint was falling back to 0x000... because the env var wasn't set. It
   now derives the real facilitator address at runtime from the private key. GET
   /supported will return our actual signer address.

2. Failed to verify payment: 400 Bad Request
   Root cause: the HTTPFacilitatorClient calls /verify and
   /settle with { paymentPayload, paymentRequirements }, but our
   endpoints were at /api/v1/facilitator/verify and expected a different payload
   format ({ txHash, amount, asset }).

We've added x402-compliant top-level route handlers:

• POST /verify -- accepts { paymentPayload, paymentRequirements }, validates
  the EIP-3009 authorization (structure, signature, timing, amount, recipient),
  returns { isValid, invalidReason? }
• POST /settle -- same input format, executes the gasless
  transferWithAuthorization on-chain, returns { success, transaction, network,
  payer }
• GET /supported -- now returns the real signer address in the signers field

Response shapes match the x402 core types (VerifyResponse, SettleResponse,
SupportedResponse) exactly. The express example should now work against
https://www.p402.io as the facilitator base URL.

We also fixed an internal env var inconsistency where the settlement service
was reading a different key