I built a self-hostable tunnel that adds Sui USDC x402 payments to local APIs

Post original

the piece id pin down first is replay protection on the X-PAYMENT proof. if a client can take the signed payment from one 402 and just resend the same header, they pay once and hit /paid forever. so the settlement has to bind the payment to a single request, a nonce or the resource path plus an expiry, and the tunnel needs to remember which payment references it already redeemed so the same on chain settlement cant be cashed twice. thats the bug that bites every facilitator style flow first other thing is youre settling synchronously in the request path, so theres no atomicity between money moved and request served. payment lands on sui, then the proxy to the local api times out or 500s, and the client just paid for nothing with no response. id make the X-PAYMENT carry an idempotency key so a retry after a failed proxy doesnt double charge, and id seriously consider verify-then-settle: check the signature and authorization inline but settle async, so a caller isnt waiting on sui finality for every paid request and a settlement hiccup doesnt eat their call