Integration Checklist

Business API — production readiness

• Issue a key with the right permissions
• Generate a fresh nonce for every request
• Generate the timestamp immediately before sending
• Keep the exact JSON body stable between signing and sending
• Send Idempotency-Key on every mutation
• Store webhook signing secrets safely

x402 API — production readiness

• Build a clean 402 retry path around PAYMENT-REQUIRED and PAYMENT-SIGNATURE
• Keep request query/body and any idempotency token stable between challenge and replay
• Treat the live x402 challenge as the source of truth for pricing and payment requirements
• Use SIGN-IN-WITH-X only for wallet-bound GET reads
• Keep X-Onchain-Execution-Access-Token for onchain execution status reads
• Parse and log PAYMENT-RESPONSE

Bottom line