Show HN: X402 Vercel Gateway – Serverless HTTP 402 for FastAPI A new open-source reference implementation, the X402 Vercel Gateway, enables serverless FastAPI endpoints to enforce the HTTP 402 Payment Required (x402) protocol for autonomous AI agents, using Solana USDC micro-transactions and Upstash Redis atomic locks to prevent replay attacks. The project, published on GitHub by developer Rob Lambert, addresses the statelessness of serverless platforms like Vercel and AWS Lambda, which otherwise allow attackers to reuse a single payment proof across concurrent requests. A production-ready reference implementation for protecting FastAPI endpoints with the HTTP 402 Payment Required x402 protocol on serverless infrastructure. Autonomous AI agents via AutoGPT, LangChain, MCP, or custom bots cannot fill out credit card forms or complete 2FA challenges. As agent-to-agent A2A economic interactions grow, APIs need a machine-native monetization standard. The x402 protocol leverages standard HTTP error codes combined with cryptographic micro-transactions Solana USDC / EVM to challenge callers for payment before serving protected compute or data. Most developers protect their gateway using an in-memory dictionary or local cache to track spent transaction hashes: ❌ THE VULNERABILITY Works in Docker, fails on Serverless burned hashes = {} if tx hash in burned hashes: raise HTTPException status code=402, detail="Replay Attack" burned hashes tx hash = True Why this breaks: On serverless platforms Vercel, AWS Lambda , compute is stateless and horizontally ephemeral. If an attacker pays 0.005 USDC once and sends 10,000 concurrent requests with the identical tx hash , Vercel spins up dozens of cold micro-VMs. Every single instance starts with an empty dictionary. All 10,000 requests pass validation, draining your upstream LLM or database quotas while you only get paid once. This gateway resolves the serverless state dilemma through a two-phase cryptographic & atomic protocol: 1. On-Chain Delta Verification: We query Solana JSON-RPC getTransaction with jsonParsed to mathematically prove that the target Associated Token Account ATA received the exact payment by computing postTokenBalances - preTokenBalances . 2. Atomic Distributed Lock SETNX : We leverage Upstash Redis with the SETNX Set if Not eXists command to achieve a globally atomic burn of the transaction hash across all serverless regions. ✅ THE FIX: Verify On-Chain, then Burn Globally is valid = await verify solana transaction tx hash, required memo=invoice id if not is valid: raise HTTPException status code=402, detail="Invalid payment proof" Atomic lock across all serverless cold starts 24h TTL acquired = redis client.set f"x402:tx:{tx hash}", current time, ex=86400, nx=True if not acquired: raise HTTPException status code=402, detail="Replay Attack Detected" sequenceDiagram autonumber participant Agent as Autonomous AI Agent participant Gateway as Vercel Edge FastAPI participant Redis as Upstash Redis SETNX participant RPC as Solana JSON-RPC Node Agent- Gateway: POST /api/v1/protected-data Gateway-- Agent: HTTP 402 Payment Required