# code402 A2A / AP2 bridge

Buy code402 pay-per-call tools from an A2A-native agent. Payments settle over x402
(EIP-3009 USDC on Base) directly from the payer to the seller wallet named in the seller's
402 challenge. This bridge holds no funds, extends no credit, and never re-prices.

- Agent Card (A2A 1.0): https://a2a.code402.dev/.well-known/agent-card.json
- JSON-RPC endpoint: POST https://a2a.code402.dev/a2a  (SendMessage, GetTask, CancelTask; 0.3 aliases accepted)
- Catalog source (live): https://code402.dev/.well-known/mcp.json — prices are dynamic; the HTTP 402 body is authoritative
- Extensions: https://github.com/google-agentic-commerce/ap2/v1 , https://github.com/google-agentic-commerce/a2a-x402/blob/main/spec/v0.2
- Health: https://a2a.code402.dev/health

Flow (one payment per task):
1. SendMessage with a data part {"skill":"<skills[].id>","input":{...}} -> Task TASK_STATE_INPUT_REQUIRED.
   Artifacts: "x402-challenge" (upstream 402 body, verbatim) and "ap2-cart-mandate" (AP2 CartMandate).
   status.message.metadata["x402.payment.status"] = "payment-required", ["x402.payment.required"] = challenge.
2. Sign EIP-3009 transferWithAuthorization from the challenge (recipient, amount, chain, nonce, EIP-712 domain, expiry).
3. SendMessage with taskId and the PaymentPayload in metadata["x402.payment.payload"] (or an AP2 PaymentMandate data part).
   -> TASK_STATE_COMPLETED with artifacts "tool-output" and "receipt", or TASK_STATE_FAILED with the seller's error relayed.
4. Re-sending the identical payment on the same task returns the same cached outcome (24h). A different payment on the same task is refused.

Money is always an integer string in minor units (USDC has 6 decimals). Never sign more than your own cap.