feat(nextjs-agentic-payments-x402): crypto-abstracted agentic payments (Dynamic + x402) - #66
feat(nextjs-agentic-payments-x402): crypto-abstracted agentic payments (Dynamic + x402)#66avneesh0612 wants to merge 1 commit into
Conversation
…s (Dynamic + x402) A Next.js + Dynamic JS SDK example where a user signs in with email, gets an embedded MPC wallet, authorizes an agent (delegated access), funds in USD, and an autonomous agent pays for services via gasless x402 (EIP-3009 USDC) — signed inside Dynamic's MPC, so no private keys touch the agent. - Web: email login -> embedded EVM wallet (guarded) -> delegateWaasKeyShares -> USD funding page. - Webhook: HMAC-verified, decrypts the delegated share (RSA-OAEP + AES-GCM). - Encrypted store: re-encrypts shares (AES-256-GCM) into Supabase; short account code per wallet (RLS on). - Paid service + x402 gate (Coinbase facilitator on mainnet, public on testnet). - Agent: resolves a user's wallet by account code, pays via x402; bridges Dynamic MPC into the x402 signer. Note: the two hex strings the secret scanner flags in lib/shared/constants.ts are public USDC token contract addresses on Base / Base Sepolia, not secrets. Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>
|
Deployment failed with the following error: |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![semgrep-code-dynamic-labs-oss[bot]](https://avatars.githubusercontent.com/u/176948624?s=60&v=4){kind=small}
| const privateKeyPem = getPrivateKey(); | ||
|
|
||
| const shareKey = rsaOaepDecryptEk(privateKeyPem, share.ek); | ||
| const walletApiKeyKey = rsaOaepDecryptEk(privateKeyPem, apiKeyEnc.ek); |
There was a problem hiding this comment.
Hardcoded sensitive data leaked
Semgrep has detected a leak of sensitive data in this code. This secret data could be used by internal or external malicious actors. We highly recommend you change, reset, or rotate the sensitive data.
A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.
💬 To ignore this, reply with:
• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by string.
|
Free public readiness snapshot for feat(nextjs-agentic-payments-x402): crypto-abstracted agentic payments (Dynamic + x402):
No invoice, no payment link, no delivery link, no private endpoint; this is only a free public snapshot. |
2 participants
What
A Next.js + Dynamic JS SDK example showing agentic payments with the crypto abstracted away: a user signs in with email, gets an embedded MPC wallet, authorizes an agent (delegated access), and "adds funds" in USD. An autonomous agent then pays for services via gasless x402 (EIP-3009 USDC) — every signature happens inside Dynamic's MPC, so no private key ever touches the agent.
Architecture
app/,components/,lib/providers.tsx— email login → embedded EVM wallet (guarded creation) →delegateWaasKeyShares→ USD funding page (light theme)app/api/webhooks/dynamic/,lib/dynamic/— HMAC-verified; decrypts the share (RSA-OAEP + AES-GCM)lib/shared/delegation-store.ts,supabase/— re-encrypts shares (AES-256-GCM) into Supabase; derives a short account code per wallet; RLS onmiddleware.ts,app/api/services/azure-compute/— Coinbase facilitator on mainnet, public facilitator on testnetagent/pay-for-service.ts— resolves a user's wallet by account code and pays via x402;lib/shared/x402-account.tsbridges Dynamic MPC into the x402 signerVerified end-to-end on Base Sepolia: authorize → webhook stores encrypted share → agent pays the x402 service gaslessly (balance debited).
Security
.env*/.vercelgitignored — only.env.exampleplaceholders tracked.lib/shared/constants.tsare the public USDC contract addresses on Base / Base Sepolia, not secrets.Notes for reviewers
@dynamic-labs-wallet1.0.28. Thepnpm-lock.yamlresolves these from the internal Dynamic registry; Vercel/CI builds need that registry's auth (e.g. anNPM_RCenv var) since some 1.8.0 sub-packages (@dynamic-labs-sdk/metamask@1.8.0) aren't on public npm yet.getMoonPayUrlhelper and drop the testnet/faucet branch.🤖 Generated with Claude Code