x402 Compliance Middleware

Try the pipeline against the deployed Worker

The reference implementation runs at x402-middleware.stablecoinatlas.com. Hit it with any of the fixtures below to watch the six-stage pipeline fire. Approved payments return a W3C Verifiable Credential receipt URL you can fetch independently.

curl -X POST https://x402-middleware.stablecoinatlas.com/ \
  -H 'Content-Type: application/json' \
  -H 'X-402-Payment: {"payerAddress":"0x1111111111111111111111111111111111111111","amount":"50.00","asset":"USDC","action":"api-call","network":"base","requestToken":"demo_001","walletType":"smart"}'

curl -X POST https://x402-middleware.stablecoinatlas.com/ \
  -H 'Content-Type: application/json' \
  -H 'X-402-Payment: {"payerAddress":"0x098B716B8Aaf21512996dC57EB0615e2383E2f96","amount":"50.00","asset":"USDC","action":"api-call","network":"ethereum","requestToken":"demo_sanctions","walletType":"smart"}'

curl -X POST https://x402-middleware.stablecoinatlas.com/ \
  -H 'Content-Type: application/json' \
  -H 'X-402-Payment: {"payerAddress":"0x2222222222222222222222222222222222222222","amount":"75.00","asset":"USDC","action":"api-call","network":"base","requestToken":"demo_struct","walletType":"smart"}'

Before any payment clears, the middleware inspects the requesting wallet's architecture. A Coinbase Smart Wallet with ERC-4337 session keys has code-enforced compliance at L3. A bare EOA has none. The compliance depth of the wallet determines which subsequent checks fire. Hover over the "YOUR WALLET" column to see each compliance block's enforcement type.

The Chainalysis OFAC sanctions oracle is a free, public smart contract on Ethereum mainnet. A single eth_call returns whether the payer's address is sanctioned per the oracle's current list. This is a hard gate — flagged addresses are blocked before any funds move. To demo a live block, pick an address the oracle currently returns as sanctioned (Lazarus Group addresses tied to the Harmony Horizon Bridge hack still return flagged as of this writing); pick any other address for a clean pass. The oracle's list evolves with OFAC's, so fixtures that worked yesterday may not tomorrow — the middleware always mirrors whatever the oracle reports.

Behavioral pattern detection runs against the payer's recent transaction history. Four heuristics fire: structuring (below-threshold splitting), round-tripping (circular flows), rapid movement (multi-hop in under one hour), and smurfing (many-to-one consolidation). The demo data below is pre-loaded with examples that trigger structuring, round-tripping, and smurfing patterns.

If the payer is an AI agent (not a human), the middleware walks the delegation chain: agent → parent agent → principal. Each link must have a valid DID, unexpired credentials, and spend authority that attenuates correctly down the chain. A sub-agent can't spend more than its parent authorized. Click any node below to inspect its DID, spend limit, and delegation metadata.

The agent's capability envelope defines what it's allowed to do: per-transaction limit, daily limit, permitted assets, permitted actions, and temporal bounds. The middleware evaluates the requested payment against all five constraints. One failure blocks the entire transaction. Adjust the envelope on the left, then test a transaction on the right to see the five-check evaluation in real time.

After the payment clears all five gates, the middleware generates a W3C Verifiable Credential receipt. The receipt binds the payer DID, payee DID, amount, settlement network, and original request token into a signed credential. Any party can verify the receipt independently — no middleware access required. Click "Verify Receipt" below to watch the four-step VC verification pipeline.

{
"@context": [
"https://www.w3.org/2018/credentials/v1"
]
,
"type": [
"VerifiableCredential",
"ACKReceipt"
]
,
"issuer": "did:web:receipts.acme-psp.com",
"issuanceDate": "2026-04-01T14:32:18Z",
"credentialSubject": {
"payer": "did:web:agent.acme-corp.com",
"payee": "did:web:vendor.eu-payments.fr",
"amount": "3500.00",
"currency": "USDC",
"settlementNetwork": "Base",
"requestToken": "req_7f3a8b2c"
}
,
"proof": {
"type": "Ed25519Signature2020",
"verificationMethod": "did:web:receipts.acme-psp.com#key-1",
"signatureValue": "eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6cmVjZWlwdHMuYWNtZS1wc3AuY29tI2tleS0xIn0"
}

};

Deploy It Yourself

The reference implementation is a single Cloudflare Worker in a standalone, MIT-licensed repo. Clone it, run the one-command deploy script, and you have your own compliance middleware running on Workers in under five minutes.

git clone https://github.com/leocarroll3/x402-compliance-middleware
cd x402-compliance-middleware
./scripts/deploy.sh