The Agentic Cookbook for x402

How to read a recipe

• Outcome: what the agent can do with the pair.
• Ingredients: the calls, in order, with what each one cost.
• The run: what happened when we ran it, with every payment on Basescan.
• Why both: what the pair does that neither service does alone.

Where the InsumerAPI check comes first, a no ends the recipe and the agent spends nothing more. Every InsumerAPI answer is signed twice: ES256 and a post-quantum ML-DSA-65 signature. Anyone can verify it against our published keys.

Recipe 1

Send a real-world reward only to members

Outcome: an agent gives a gift card, eSIM or phone top-up only to members whose wallets meet a rule: holding a member pass issued by Skye Meta's Bothy, an NFT, or a number of tokens. The member gets the reward. The agent keeps a signed record of why.

Ingredients

1. The member freeSigns a one-time message with their wallet, so the agent knows the wallet is theirs. Checking a wallet's holdings does not prove who controls it.
2. InsumerAPI POST /v1/attest $0.05Does that wallet meet the rule? A no ends the recipe.
3. Bitrefill GET /x402/gift-cards/search $0.002Find the reward for the member's country.
4. Bitrefill POST /x402/invoice/create $0.002Lock the price.
5. Bitrefill POST /x402/invoice/pay the rewardPay for the reward.
6. Bitrefill GET /x402/invoice/status freeThe agent signs in with the wallet that paid and collects the code, then sends it privately to the member.

{
  "wallet": "0xMEMBER_WALLET",
  "format": "jwt",
  "conditions": [{
    "type": "token_balance",
    "chainId": 8453,
    "contractAddress": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "threshold": "1",
    "label": "Holds 1 USDC on Base"
  }]
}

For a pass or any other NFT, use "type": "nft_ownership" with the pass's contract address.

The run

The member signed a challenge and the agent verified it. The rule was "holds at least 1 USDC on Base", and InsumerAPI answered yes (attestation ATST-96EC936E40A1815C, the signed answer). Bitrefill priced a $5 Amazon.com gift card at $5.25 and took payment. About 3 seconds later the agent signed in with its paying wallet, collected the code and handed it to the member. In this run the member and the agent were both us, so we redeemed the card ourselves:

Payments: check · search · invoice · gift card

Total: $5.304 ($0.054 in calls, $5.25 for the card)

Why both: Bitrefill sells the reward with no account and no card number. InsumerAPI decides who gets one, and the signed answer explains every payout.

Recipe 2

Check what an agent holds before hiring it

Outcome: before paying another agent for a job, the agent confirms it is a registered ERC-8004 agent and, at that moment, holds a set multiple of the job's value.

Ingredients

1. trust-agent.io GET /v1/reputation?chain=base&subject=AGENT_ID $0.002ERC-8004 reviews, with reviewers that share a funder counted once.
2. InsumerAPI POST /v1/attest $0.05Owns the agent, and holds 10 times the job in USDC? Two conditions, one signed answer.
3. Any x402 service the jobPay for the job, or walk away.

{
  "wallet": "0xAGENT_OWNER_WALLET",
  "format": "jwt",
  "conditions": [
    { "type": "erc8004_agent", "chainId": 8453, "agentId": "AGENT_ID",
      "label": "Owns the ERC-8004 agent" },
    { "type": "ratio_to_amount", "chainId": 8453,
      "contractAddress": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "multiple": "10", "amount": "1",
      "label": "Holds 10x a $1 job in USDC" }
  ]
}

The erc8004_agent check passes for the agent's owner or for the wallet the registry binds to the agent. If your rule is ownership, also require "matchedVia": "owner" in the result.

Why both: reviews tell the agent how others rated past work. The attestation tells it what the other agent holds at the moment of hiring. It is a check at one moment, not a bond or escrow. Selling to agents instead of hiring them? See how to check an AI agent before it pays you. Why this run matters: what x402 doesn't tell your agent.

Recipe 3

Enforce a rule written in dollars

Outcome: the agent enforces "holds at least $100 of WETH" and gets a signed yes or no.

Ingredients

1. CoinGecko GET /api/v3/x402/onchain/simple/networks/base/token_price/TOKEN $0.005Today's price. Divide the dollar rule by it and round up, so the threshold is never below the rule.
2. InsumerAPI POST /v1/attest $0.05The token amount becomes the threshold.

{
  "wallet": "0xWALLET",
  "format": "jwt",
  "conditions": [{
    "type": "token_balance",
    "chainId": 8453,
    "contractAddress": "0x4200000000000000000000000000000000000006",
    "threshold": "0.0484202881007142",
    "label": "Holds $100 of WETH at 2065.25"
  }]
}

Why both: InsumerAPI thresholds are token amounts. CoinGecko turns a dollar rule into one.

Recipe 4

Learn what people say about a wallet, and what it holds

Outcome: before dealing with a wallet, the agent has its standing with people and signed facts about its holdings.

Ingredients

1. Ethos GET /x402/user/address/WALLET $0.001Profile, linked X account and a credibility score built from reviews and vouches.
2. InsumerAPI POST /v1/trust $0.15A signed fact profile across 10 dimensions. No score, no opinion, just cryptographically verifiable evidence organized by dimension.

{ "wallet": "0xWALLET" }

Why both: Ethos tells the agent how people rate the wallet's owner. InsumerAPI tells it what the chain shows, signed.

Recipe 5

Buy research only for wallets that qualify

Outcome: an agent that offers paid search or data spends on it only when the requesting wallet meets the rule.

Ingredients

1. InsumerAPI POST /v1/attest $0.05Does the requesting wallet qualify? If your policy checks the paying wallet, use the verified x402 payer address for this request. If it checks a different wallet, require a signed challenge from that wallet first. Never trust an address the requester only typed in. A no ends the recipe.
2. Exa POST /search $0.007The research, bought only after the answer is verified. Any paid search or data service on x402 fits here.

npm install viem insumer-verify @noble/post-quantum
curl -o jwks.json https://insumermodel.com/.well-known/jwks.json
PRIVATE_KEY=0x... node recipe-5.mjs --dry   # quotes and signs, sends nothing
PRIVATE_KEY=0x... node recipe-5.mjs         # spends $0.057 in USDC on Base

Why both: the research is what the agent sells. The check decides who gets it and records why.

Run them yourself

Each call is a plain HTTP request. The first response is a 402 with the price. The agent signs a USDC payment and sends the same request again. InsumerAPI needs no API key on this path and takes USDC on Base, Polygon, Arbitrum, Arc or Solana. The payer is charged only for a successful answer, and the payer sees the answer only after the payment settled.

To check a published answer yourself, offline: download it and our public keys once, then verify with nothing fetched. Read the verdicts one by one. Every answer expires 30 minutes after it was signed, so after that v.valid is false even though both signatures still verify.

curl -O https://insumermodel.com/x402-cookbook/evidence/recipe-5-attestation.json
curl -o jwks.json https://insumermodel.com/.well-known/jwks.json
npm install insumer-verify @noble/post-quantum
node verify.mjs

import { verifyAttestation } from "insumer-verify";
import fs from "node:fs";

// Both files downloaded once. Nothing is fetched below.
const answer = JSON.parse(fs.readFileSync("recipe-5-attestation.json", "utf8"));
const jwks = JSON.parse(fs.readFileSync("jwks.json", "utf8"));

const v = await verifyAttestation(answer, { jwks, mode: "evidence" });
console.log("ES256 signature verified:", v.checks.signature.passed);
console.log("ML-DSA-65 signature:", v.checks.pq.status);
console.log("Condition hashes match:", v.checks.conditionHashes.passed);
console.log("Still within its 30 minutes:", v.checks.expiry.passed);

The projects in these recipes: Bitrefill, trust-agent.io, CoinGecko, Ethos, Exa and Skye Meta's Bothy.

The five recipes cost $5.62 to run, $5.25 of it for the gift card. Prices for other services are what each one charged on 10 November 2026 and may change. The services named here are independent companies: each recipe calls their public x402 endpoints, and no partnership is implied. Skye Meta, which makes Bothy, builds on InsumerAPI.