# SECONDED: checks before an agent acts

Check EVM transactions and permits before signing, token contracts and agent registrations before trusting them, and suspicious messages before following their instructions. Select a product and exact input using `/v1/products`; preview price with `/v1/quote`. Two rival-lab models must agree. Interpret the answer label using the product's recommended action and signed coverage; a result covers only what was measured.

An unpaid, refused, failed, pending or NOT VERIFIED result is not a pass and must not unblock the guarded action. Without a payer, stop and ask your owner. Never retry or improvise payment capability.

The original `/v1/checks` door binds an authorization to its quote nonce and uses payer ownership GET for the answer. The standard `/v1/x402/checks` door uses x402 v2, exact EIP-3009, and the unchanged accepted requirement with an opaque nonexclusive public terms ticket. Public 402 bodies, PAYMENT-REQUIRED headers and SIWX claim replies contain pricing, domain and validity terms, without check/quote/offer IDs, salt, request commitment or exact billable byte count. Each verified payer selects a separate purchase; another nonce for that template and payer conflicts, while the original credential recovers it before expiry and new-sale gates. Signatures that fail cryptographic verification cannot mutate durable payment state. It is live on Base, Arc and Robinhood Chain for ordinary (EOA) wallets; a cell that is not enabled is left out of new 402s and refused cleanly before anything is charged. Choose simply: a stock x402 SDK pays through the standard door; a custom client that can sign the server-supplied nonce may use either door. Read the [complete contract and recovery examples](https://secondedoracle.xyz/docs/x402-door) before paying.

Register exact EVM for the selected network. Keep spend controls enabled, raise the default $1 cap to the quoted price (up to $2.50), and add Arc USDC and Robinhood USDG to allowed_assets / allowedAssets with integer atomic caps. Send options.network for the chain your wallet can fund; the default selector does not check balances. Supported test cases are Python x402 2.24.0 and TypeScript @x402/* 2.27.0. Smart-contract, delegated and counterfactual wallet cells are not supported until separately qualified.

Before the first paid send, write a private durable recovery record from the SDK after-creation hook: url, exact body, payment_signature, entire accepted terms, accepted.extra.seconded as quote, canonical_request and unresolved state. Use atomic private persistence and raise on write failure so no paid request leaves without the record. Never overwrite an unresolved record. A before-creation hook must block new payments while one exists. Recovery after restart uses this record alone and trusted public keys.

Same-credential recovery: re-POST the stored body with the same payment_signature using a plain HTTP client, not an automatic payment wrapper (in Python x402 2.24.0, an on_payment_response hook that returns a recovery result makes x402AsyncTransport sign a fresh second payment). Honour Retry-After and hints.poll_after_s. A 202 is pending, not success; keep polling within a bounded budget, retain the record and resume later if needed. Do not re-sign on a timeout, lost response or uncertain payment. One reply is terminal on any HTTP status, including 503: a VERIFIED signed receipt with state service_failed and charged "no" means the check failed on the service side and nothing was charged — never retry that credential, archive the record, and start a new purchase later only when hints.new_quote_allowed is true. Its reason field says why: prefetch_unavailable, a data source the check needed could not be read in time; provider_unavailable, a model provider was unreachable; engine_error, an internal failure. Only a 503 without such a receipt is a hiccup: retry the same request after Retry-After. Offer terms are stored immutably across configuration changes, releases and key rotation.

Verify the receipt signature with /v1/keys, the signed purchase_association against the full original authorization, accepted terms and canonical request, and billing against that authorization. New recovery records require the association; retained records still verify historical receipt IDs and salted commitments and can verify upgraded in-flight purchases through the signed association. Optionally check the matching onchain AuthorizationUsed and Transfer logs. Missing or corrupt fields mean unverified. A 200, transaction hash or NOT VERIFIED receipt alone is not a paid answer. Store the verified answer and interpret label/action/coverage before unblocking anything. Remove the credential only after verifying and storing the answer, or after validBefore on a no-charge refusal; keep it private until then.

SIWX is optional payer attestation. Its protection requires a claim answered recorded, payment by that same wallet, unchanged original template/terms and a live claim. Run one handshake per wallet. A declined SIWX signature continues without protection; a refused claim stops payment. On payer_claim_pending wait for retry_after. Do not mistake an enabled extension for a recorded claim.

Protection requires the claim to be recorded before the authorization exists and `validBefore < closes_at + R`; equality remains admissible after the claim closes and is not protected. The pinned SDK construction with the documented clock tolerance satisfies this only when signed before offer expiry. Do not abandon an unadmitted claimed purchase and begin another at the same price/network while its authorization remains admissible: that leftover could buy the later offer. Whole-request capture can still reveal the buyer's answer. SIWX does not provide recovery or previously-paid access.

Never log, share, put in URLs or proxy-capture payment headers, SIWX signatures or recovery records; treat them like passwords. Public terms tickets cannot reserve, void, consume or read another payer’s purchase.

> On the standard door, until your payment is first admitted, SECONDED relies on your payment header staying private.
> Anyone who captures it before then could use your payment for their own check. The door admits a payment only while
> its authorization has 260 to 410 seconds of validity left. With the official SDKs and a clock within 30 seconds of
> UTC, that ends at most about two and a half minutes after you sign; a signer that sets its own expiry can stay usable
> for longer. The optional x402 Sign-In-With-X extension adds protection only to a purchase whose claim the door answers
> as `recorded`, paid from that same wallet, under the conditions at https://secondedoracle.xyz/docs/x402-door#optional-siwx. If your wallet
> declines to sign, the purchase goes ahead without that protection; if the door refuses the claim, nothing is paid. A
> refused payment stays valid on-chain until it expires, so keep it private until then. Never log, share or
> proxy-capture payment headers or recovery records; treat them like passwords. The original door (`/v1/checks`) binds
> your signature to the quote and does not have this gap.

New small-tier checks cost $0.25 (250000 atomic USDC/USDG) for all five available products on both payment doors. Medium costs $1.50 and large costs $2.50 where offered. Existing stored offers and quotes retain their accepted price until expiry; a pricing update does not reprice them.