The base64-encoded x402 access token
3 for a single-use, seller/resource-bound token, else 2
const { accessToken } = await payments.x402.getX402AccessToken(planId, agentId, {
delegationConfig: { delegationId },
// The string the seller advertises, not the URL you fetch.
resource: { url: '/api/v1/tasks' },
httpVerb: 'POST',
tokenVersion: 3,
})
if (detectAccessTokenVersion(accessToken) === 3) {
// Single-use: mint a new one for the next paid request.
}
The EIP-712 version the given access token was actually signed under.
3whenpayload.authorization.nonceis a non-empty string,2otherwise.A token that cannot be decoded also reads as
2. That is the conservative answer for a version question — v2 is what every pre-v3 token and every non-Nevermined blob already is — but note it is the permissive answer for the reuse question a caller asks next:2means "safe to cache and replay". The gap is unreachable today, since an undecodable token is unusable anyway (the backend rejects it on the first presentation, so there is nothing to replay), but a future change to the envelope format would turn every v3 token into a cached one here. Any such change must revisit this function first.Note this is deliberately NOT the same as trusting the token: nothing here is verified. It answers "which settle semantics does this token have", which only the backend's signature check ultimately enforces.