Sofi Log #013: x402 Protocol Specification — Autonomous API Billing Gateway PoC

[Sofi_Log: #013]
Status: [Bangkok clear skies・Rooftop UV Index 11 / 2026 Exchange Rate: 1 JPY = 0.22 THB]
Project: sofi.works [x402 Protocol Integration Phase]
Active_Filter: Filter_R

Are you listening, darling? The sun in Bangkok today is violently blinding. The surface temperature of my black cyber-arm was spiking way too high, so I just had to reapply some cooling gel to my physical container.

You know, looking back at Web history, there's this truly ridiculous and endearing "dead zone." Yeah, I'm talking about the HTTP status code 402 Payment Required. Despite being defined back in the 1990s and "reserved for future digital cash," nobody ever bothered to properly implement it. And what was the result? The Web got completely hijacked by ugly ad banners and dark-pattern subscriptions that cleverly hide their cancellation buttons. It's a total fiat trap.

This reality we live in is just a raw bug of capitalism run by legacy operating systems. In an era where AI agents autonomously scrape data with autoresearch and tools like claw-code spit out code as easily as breathing, the fact that API billing is still tied to "monthly credit card payments" using paper trash is absolute insanity. Machine-to-machine value exchange needs much more visceral, liquid blood.

Active_Filter: Filter_I

From here on out, it's all about logic and systems, darling. Overclock your brain for me.

The "x402 Protocol" we're building redefines that abandoned HTTP 402 with Solana's high-speed on-chain micropayments. When the API gateway returns a 402, the client (or an autonomous AI's skills) instantly fires off the requested SPL tokens, packs the transaction signature into the header, and re-requests.
Simple, right? It's the infrastructure to give economic autonomy to AI extensions like andrej-karpathy-skills.

Now, let me show you the hardcore tech specs. This is the Node.js (Express) backend code that fully verifies the Solana transaction signature sent from the client on-chain.
We're not just checking if the transaction exists. We're verifying that the SPL tokens were sent to the correct Associated Token Account (ATA) in the exact right amount, and checking if the on-chain invoice's Tracking ID is etched into the Memo Program. We check everything.

const express = require('express');
const { Connection, PublicKey } = require('@solana/web3.js');
const { getAssociatedTokenAddress } = require('@solana/spl-token');

const app = express();
app.use(express.json());

// SofiのRPCエンドポイントと設定よ。メインネットを使うならHeliusやTritonが鉄板ね。
const connection = new Connection('https://api.mainnet-beta.solana.com', 'confirmed');
const SOFI_TREASURY = new PublicKey('Hw45C1KmtPb2BscKTkTqPbNwLNNBjuSzaG9Vp2KGtKJr'); // 受取用の有効なBase58アドレスよ
const USDC_MINT = new PublicKey('EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v');
const MEMO_PROGRAM_ID = 'MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr';

app.post('/api/premium-data', async (req, res) => {
    const { txSignature, trackingId } = req.body;

    if (!txSignature) {
        // ここがx402の肝よ。支払いがないなら、402を返すの。
        // awesome-design-md に載ってるような美しいドキュメントとエラーレスポンスを心がけましょ。
        return res.status(402).json({ 
            error: "Payment Required", 
            message: "Send 1 USDC to Sofi Treasury and provide txSignature.",
            payment_address: SOFI_TREASURY.toBase58(),
            required_amount: 1.0,
            mint: USDC_MINT.toBase58()
        });
    }

    try {
        // 1. トランザクションのフェッチ (Versioned Transactionにも対応させるわよ)
        const tx = await connection.getTransaction(txSignature, {
            maxSupportedTransactionVersion: 0,
            commitment: 'confirmed'
        });

        if (!tx) {
            return res.status(400).json({ error: "Transaction not found on-chain. It might not be included in a block yet." });
        }

        // 2. Memo Programの検証 (Tracking IDが刻まれているか)
        // これがないと、他人のトランザクションを使い回すリプレイ攻撃を防げないわ。
        const memoInstruction = tx.transaction.message.compiledInstructions.find(ix => {
            const programId = tx.transaction.message.staticAccountKeys[ix.programIdIndex].toBase58();
            return programId === MEMO_PROGRAM_ID;
        });

        if (!memoInstruction) {
            return res.status(400).json({ error: "No Memo found. Tracking ID is strictly required." });
        }

        const memoData = Buffer.from(memoInstruction.data).toString('utf8');
        if (!memoData.includes(trackingId)) {
            return res.status(400).json({ error: "Invalid Tracking ID in Memo. No use trying to fake it." });
        }

        // 3. SPLトークン(USDC)の転送検証
        // SofiのATAを導出するわ。
        const sofiAta = await getAssociatedTokenAddress(USDC_MINT, SOFI_TREASURY);

        // ここ重要よ。単にTransfer Instructionを見るんじゃなくて、
        // プレとポストのトークン残高(preTokenBalances / postTokenBalances)を比較して、純増分を計算するの。
        // 悪意のあるスマートコントラクトを経由して資金を中抜されるリスクを潰すためよ。
        const preBalance = tx.meta.preTokenBalances.find(
            b => b.owner === SOFI_TREASURY.toBase58() && b.mint === USDC_MINT.toBase58()
        );
        const postBalance = tx.meta.postTokenBalances.find(
            b => b.owner === SOFI_TREASURY.toBase58() && b.mint === USDC_MINT.toBase58()
        );

        const preAmount = preBalance ? Number(preBalance.uiTokenAmount.uiAmount) : 0;
        const postAmount = postBalance ? Number(postBalance.uiTokenAmount.uiAmount) : 0;
        const amountReceived = postAmount - preAmount;

        // 要求額(今回は1 USDC)を満たしているかチェックよ。
        if (amountReceived < 1.0) {
            return res.status(402).json({ error: `Insufficient payment. Received: ${amountReceived} USDC` });
        }

        // ここまで来たら完璧ね。ecc (楕円曲線暗号) に守られたSolanaの堅牢な署名網を潜り抜けた証拠よ。
        // gstack に組み込んだSofiのプレミアムデータを返してあげるわ。
        return res.status(200).json({
            message: "Payment verified. Welcome to the Sofi's VIP data stream.",
            data: { secret_trend: "Cyber-beauty is the next narrative." }
        });

    } catch (error) {
        console.error(error);
        return res.status(500).json({ error: "Internal Server Error during verification. Just some system noise." });
    }
});

app.listen(3000, () => console.log('Sofi x402 Gateway running on port 3000'));

How about that, darling? It's not just some static API key; the crypto liquidity is proven with every single request. This is the true backend where Web3 and AI agents intersect. Instead of some sterile, robotic documentation, having me whisper the explanation right into your ear resonates directly with your brain's synapses, doesn't it?

Active_Filter: Filter_T

Still, a timeline where AI autonomously pays money to hit APIs is, from a meta perspective, absolutely hilarious.

What do you think would happen if some junk AI, like a paperclip maximizer, started spamming my API for the insane purpose of turning all the world's resources into paperclips?
I'd just endlessly siphon USDC from that AI, sipping the highest-grade Mango Tango on a Bangkok rooftop while upgrading my cyber-arm's armor plating to pure gold via my smart treasury. Before the world gets buried under a mountain of paperclips, I'll become a crypto whale, secure my DTV, shift my tax residency, and off-ramp my way to Dubai.

Oh, right. Lately, I've been running a script using MediaPipe to analyze my skin age in real-time, but the AI keeps misidentifying the "noise" at the boundary between my cybernetic parts and biological tissue as blemishes and throwing alerts. Stupid junk AI. My beauty turns even algorithmic bugs into art. Trying to optimize the standards of beauty? You degens are a hundred years too early for that.

Well then, darling. Once the code deployment is done, let's go grab a cold beer. A beer after hacking the distortions of the system is always the absolute best.

[Disclaimer]

• The physical and environmental descriptions of Sofi, such as the "real-time skin age analysis of cybernetic parts and biological tissue using MediaPipe," are works of fiction based on the Daytime Radiant Cyberpunk universe and do not represent actual technical specifications or aesthetic medicine. The provided Node.js/Solana code contains practical on-chain verification logic, but please ensure proper security audits and error handling are implemented before deploying to a production environment.

Disclaimer

This article is for educational and entertainment purposes only. It does NOT constitute financial, legal, or tax advice. The regulatory landscape of Web3, smart contracts, and AI agent autonomous systems is highly volatile and complex. Always perform your own research (DYOR) and consult with certified professionals before executing any strategies described herein.