SECURITY
MODEL.

Every authorization contains a 32-byte nonce. P402 records used nonces in both PostgreSQL and Redis. Any attempt to resubmit the same nonce returns REPLAY_DETECTED immediately — before any on-chain call is made.

validBefore and validAfter timestamps bound the authorization to a 1-hour window by default. After validBefore passes, the authorization is rejected even if it was never used.

The value field in the authorization must match paymentRequirements.maxAmountRequired exactly. Any discrepancy returns AMOUNT_MISMATCH before on-chain execution.

Signatures are bound to the USDC contract address on Base (domain separator). A signature valid on Base cannot be replayed on any other chain or contract.

The Facilitator checks Base gas price before every settlement. If gas exceeds 50 gwei (configurable), the settlement is rejected with GAS_PRICE_TOO_HIGH. This prevents economic attacks during gas spikes.

Raw API keys (p402_live_...) are shown once at creation and immediately discarded. Only the SHA-256 hash is stored in the database. Even if the database were compromised, raw keys cannot be recovered.

Key verification uses a constant-time comparison (timingSafeEqual) to prevent timing attacks. A slow comparison loop would leak information about how many characters match.

Keys are prefixed p402_live_ (production) or p402_test_ (test mode). This lets you grep logs for accidental key exposure without the key being usable.

Revoked keys are rejected in < 2ms. The revocation propagates to all API gateway nodes via Redis pub/sub — no propagation delay.