DEV Community

Rob Lambert
Rob Lambert

Posted on

Building a Serverless HTTP 402 Payment Gateway for FastAPI with Solana and Redis

#api #crypto #python #serverless

Autonomous AI agents (via AutoGPT, LangChain, MCP, or custom bots) cannot fill out credit card forms or complete 2FA challenges. As agent-to-agent (A2A) economic interactions grow, APIs need a machine-native monetization standard.

The x402 protocol leverages standard HTTP error codes combined with cryptographic micro-transactions (Solana USDC / EVM) to challenge callers for payment before serving protected compute or data.

🚨 The Fatal Flaw: Ephemeral State in Serverless

Most developers protect their gateway using an in-memory dictionary or local cache to track spent transaction hashes:

# ❌ THE VULNERABILITY (Works in Docker, fails on Serverless)
_burned_hashes = {}
if tx_hash in _burned_hashes:
    raise HTTPException(status_code=402, detail="Replay Attack")
_burned_hashes[tx_hash] = True
Enter fullscreen mode Exit fullscreen mode

Why this breaks:
On serverless platforms (Vercel, AWS Lambda), compute is stateless and horizontally ephemeral. If an attacker pays 0.005 USDC once and sends 10,000 concurrent requests with the identical tx_hash, Vercel spins up dozens of cold micro-VMs. Every single instance starts with an empty dictionary. All 10,000 requests pass validation, draining your upstream LLM or database quotas while you only get paid once.

🛡️ The Solution: Atomic Distributed State + On-Chain Proof

The x402-vercel-gateway resolves the serverless state dilemma through a two-phase cryptographic & atomic protocol:

  1. On-Chain Delta Verification: We query Solana JSON-RPC (getTransaction with jsonParsed) to mathematically prove that the target Associated Token Account (ATA) received the exact payment by computing postTokenBalances - preTokenBalances.
  2. Atomic Distributed Lock (SETNX): We leverage Upstash Redis with the SETNX (Set if Not eXists) command to achieve a globally atomic burn of the transaction hash across all serverless regions. 
# ✅ THE FIX: Verify On-Chain, then Burn Globally
is_valid = await verify_solana_transaction(tx_hash, required_memo=invoice_id)
if not is_valid:
    raise HTTPException(status_code=402, detail="Invalid payment proof")

# Atomic lock across all serverless cold starts (24h TTL)
acquired = redis_client.set(f"x402:tx:{tx_hash}", current_time, ex=86400, nx=True)
if not acquired:
    raise HTTPException(status_code=402, detail="Replay Attack Detected")
Enter fullscreen mode Exit fullscreen mode

Check out the complete open-source reference implementation on GitHub:
👉 https://github.com/roblambert9/x402-vercel-gateway

Top comments (0)