Executable x402 v2 buyerBase Mainnet
One runnable agent recipe goes from Coinbase Bazaar discovery to a source-linked Maha Context Pack. It supports CDP Server Wallets and plain Viem accounts, and it will not sign if the live terms exceed $0.005 or differ from the expected $0.001 purchase.
The gates
Gate 1
Use semantic search filtered on Base Mainnet, the exact USDC contract address 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, exact-payment, and maxUsdPrice=0.005. The asset filter takes a contract address: a bare symbol such as "usdc" matches nothing and returns an empty page rather than an error. If the asynchronous semantic index has not refreshed, use Bazaar merchant discovery as the exact indexed fallback.
Gate 2
Read the discovered input example plus input and output JSON Schemas. Refuse missing or malformed discovery metadata. To decide which offer to call in the first place, read the machine-readable Maha offer selection guide at /.well-known/maha/offer-selection.json.
Gate 3
Require Base Mainnet, native Base USDC, the published Maha payee, exactly 1,000 base units, and a hard ceiling of 5,000 base units.
Gate 4
Load either a plain Viem account or a named CDP Server Wallet only after discovery and policy checks pass. Re-check the live 402 terms before producing a signature.
Gate 5
Require PAYMENT-RESPONSE success, a Base transaction hash, the expected network, and the signing wallet as payer.
Gate 6
Validate the paid response shape and produce a downstream prompt that preserves source-linked passage citations.
Run the machine flow
npm run recipe:bazaar-paymentSearches Bazaar, inspects schemas, and evaluates terms. It never loads a wallet.
X402_BUYER_PRIVATE_KEY=0x… npm run recipe:bazaar-payment -- --pay --wallet=viemUses a dedicated limited-balance EOA. The key stays in the process environment.
npm install --save-dev @coinbase/cdp-sdk
CDP_ACCOUNT_NAME=maha-agent npm run recipe:bazaar-payment -- --pay --wallet=cdpAlso requires CDP_API_KEY_ID, CDP_API_KEY_SECRET, and CDP_WALLET_SECRET in the environment.
Fund only the selected Base account with the USDC needed for the test. Do not commit wallet secrets, use a personal high-balance wallet, or remove the local policy checks.
Local policy
The recipe evaluates the catalog requirement, then independently evaluates the live PAYMENT-REQUIRED challenge immediately before signing. A changed price, asset, network, payee, or scheme fails closed.
After the API responds, the recipe decodes PAYMENT-RESPONSE and binds the success receipt to the wallet, Base network, and on-chain transaction before using the body.
function assertSpendPolicy(requirement) {
if (requirement.scheme !== 'exact') throw new Error('scheme')
if (requirement.network !== 'eip155:8453') throw new Error('network')
if (requirement.asset.toLowerCase() !== BASE_USDC) throw new Error('asset')
if (requirement.payTo.toLowerCase() !== MAHA_PAYEE) throw new Error('payee')
const amount = BigInt(requirement.amount)
if (amount > 5_000n) throw new Error('spend ceiling')
if (amount !== 1_000n) throw new Error('unexpected price')
}Boundaries