diff --git a/.changeset/chubby-peas-sip.md b/.changeset/chubby-peas-sip.md
index 445677032..96dd51184 100644
--- a/.changeset/chubby-peas-sip.md
+++ b/.changeset/chubby-peas-sip.md
@@ -5,10 +5,12 @@
Updated the `@turnkey/gas-station` SDK to align with the audited smart contract changes. The audit resulted in several interface updates:
**Contract Changes:**
+
- **New contract addresses**: Updated both delegate and execution contract addresses to the newly deployed versions
- **EIP-712 field name changes**: The canonical delegate contract interface uses simplified field names (`to`, `value`, `data`) instead of the previous descriptive names (`outputContract`, `ethAmount`, `arguments`)
**SDK Updates:**
+
- Updated `DEFAULT_EXECUTION_CONTRACT` address from `0x4ece92b06C7d2d99d87f052E0Fca47Fb180c3348` to `0x00000000008c57a1CE37836a5e9d36759D070d8c`
- Updated `DEFAULT_DELEGATE_CONTRACT` address from `0xC2a37Ee08cAc3778d9d05FF0a93FD5B553C77E3a` to `0x000066a00056CD44008768E2aF00696e19A30084`
- Updated EIP-712 Execution typehash field names to match the contract's canonical interface
@@ -17,6 +19,7 @@ Updated the `@turnkey/gas-station` SDK to align with the audited smart contract
- Updated documentation and examples to reflect the new field names
**Files Modified:**
+
- `packages/gas-station/src/config.ts` - Updated contract addresses
- `packages/gas-station/src/intentBuilder.ts` - Updated EIP-712 type definitions and message objects
- `packages/gas-station/src/policyUtils.ts` - Updated policy condition field references and documentation
diff --git a/examples/with-x402/.env.local.example b/examples/with-x402/.env.local.example
new file mode 100644
index 000000000..b05f3b0e9
--- /dev/null
+++ b/examples/with-x402/.env.local.example
@@ -0,0 +1,5 @@
+NEXT_PUBLIC_ORGANIZATION_ID="your-turnkey-organization-id"
+NEXT_PUBLIC_AUTH_PROXY_ID="your-turnkey-auth-proxy-config-id"
+
+NEXT_PUBLIC_FACILITATOR_URL=https://www.x402.org/facilitator # This is a public, free, community maintained facilitator URL for x402; replace if you have your own
+NEXT_PUBLIC_RESOURCE_WALLET_ADDRESS=0xYourResourceWalletAddressHere # This is the resource wallet address where payments will be sent. Replace with your own eth wallet address.
diff --git a/examples/with-x402/.eslintrc.json b/examples/with-x402/.eslintrc.json
new file mode 100644
index 000000000..bffb357a7
--- /dev/null
+++ b/examples/with-x402/.eslintrc.json
@@ -0,0 +1,3 @@
+{
+ "extends": "next/core-web-vitals"
+}
diff --git a/examples/with-x402/.gitignore b/examples/with-x402/.gitignore
new file mode 100644
index 000000000..d02289af7
--- /dev/null
+++ b/examples/with-x402/.gitignore
@@ -0,0 +1,42 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.js
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# local env files
+.env*.local
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts
+
+# Playwright
+node_modules/
+/test-results/
+/playwright-report/
+/blob-report/
+/playwright/.cache/
diff --git a/examples/with-x402/README.md b/examples/with-x402/README.md
new file mode 100644
index 000000000..4b78170bb
--- /dev/null
+++ b/examples/with-x402/README.md
@@ -0,0 +1,73 @@
+# x402 with Turnkey Embedded Wallets
+
+This example demonstrates how to use Coinbase's x402 payment protocol with Turnkey's embedded wallets for seamless payment authentication.
+
+## Overview
+
+This demo shows how to build a custom x402 middleware that integrates with Turnkey's embedded wallet system instead of relying on browser wallet extensions.
+
+## How It Works
+
+### 1. Middleware-Based Access Control
+
+The demo uses Next.js middleware to gate access to protected content. The middleware (`middleware.ts`) intercepts requests to `/protected/*` routes and checks for a `payment-session` cookie:
+
+- **If the cookie exists**: The user has made a valid payment and can access the protected content
+- **If the cookie is missing**: The user is redirected to the paywall page to complete payment
+
+This means the server is responsible for gating the access to the protected page. The cookie only lasts for 5 minutes and can be cleared before if needed.
+
+### 2. Turnkey-Powered Payment Authorization
+
+The payment page (`app/paywall/page.tsx`) uses Turnkey's embedded wallets to sign the payment authorization:
+
+1. **Authentication**: Users log in to a Turnkey sub-org using the [`@turnkey/react-wallet-kit`](../../packages/react-native-wallet-kit/) package, which handles authentication with different methods
+2. **Sign EIP-712 Payload**: The user signs an EIP-3009 `TransferWithAuthorization` message for USDC on Base Sepolia using the [`@turnkey/viem`](../../packages/viem/) package. This is a gasless transfer authorization that includes:
+ - The sender (`from`) and recipient (`to`) addresses
+ - The payment amount (0.01 USDC in this demo)
+ - Validity period (5 minutes)
+ - A unique nonce to prevent replay attacks
+3. **Encode & Submit**: The signed authorization is encoded in x402 format using the [`x402`](https://www.npmjs.com/package/x402) package and submitted to the server for verification
+
+### 3. Payment Verification with Public Facilitator
+
+After the payload is signed, the [server route](./app/api/verify-payment/route.ts) uses a [public x402 facilitator](https://www.x402.org/facilitator) to verify the payment:
+
+1. **Decode Payment**: The EIP-712 signed payment payload is decoded from the x402 format using the [`x402`](https://www.npmjs.com/package/x402) package
+2. **Verify**: The facilitator's `/verify` endpoint validates that:
+ - The signature is valid and signed by the claimed payer
+ - The payment meets the requirements (amount, asset, recipient, timing)
+ - The nonce hasn't been used before
+3. **Settle**: If valid, the facilitator's `/settle` endpoint records the payment as settled
+4. **Set Cookie**: Upon successful verification, a `payment-session` cookie is set with a 5-minute expiration
+
+The facilitator acts as a neutral third party that verifies payments without requiring the merchant to run their own verification infrastructure. You can also host your own facilitator.
+
+## Running The App
+
+To start, ensure you have a [Turnkey organization setup](https://docs.turnkey.com/getting-started/quickstart) with [Auth Proxy enabled.](https://docs.turnkey.com/sdks/react/getting-started#turnkey-organization-setup)
+
+### Configure your `.env.local` file
+
+Copy the [`.env.local.example`](./.env.local.example) file and rename it to `.env.local` then fill in the following fields:
+
+```
+NEXT_PUBLIC_ORGANIZATION_ID="your-turnkey-organization-id"
+NEXT_PUBLIC_AUTH_PROXY_ID="your-turnkey-auth-proxy-config-id"
+
+NEXT_PUBLIC_FACILITATOR_URL=https://www.x402.org/facilitator # This is a public, free, community maintained facilitator URL for x402; replace if you have your own
+NEXT_PUBLIC_RESOURCE_WALLET_ADDRESS=0xYourResourceWalletAddressHere # This is the resource wallet address where payments will be sent. Replace with your own eth wallet address.
+```
+
+You can use any Ethereum wallet address to act as a resource wallet. The Base Sepolia USDC will go there.
+
+### Start the Development Server
+
+Install the packages and run the dev server:
+
+```bash
+pnpm i
+pnpm run dev
+```
+
+You'll see the demo running on http://localhost:3000.
diff --git a/examples/with-x402/app/api/verify-payment/route.ts b/examples/with-x402/app/api/verify-payment/route.ts
new file mode 100644
index 000000000..6e744ccfd
--- /dev/null
+++ b/examples/with-x402/app/api/verify-payment/route.ts
@@ -0,0 +1,98 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { exact } from "x402/schemes";
+import { PAYMENT_REQUIREMENTS, COOKIE_TIMEOUT_SECONDS } from "../../constants";
+
+export async function POST(req: Request) {
+ try {
+ const { paymentHeader } = await req.json();
+
+ if (!paymentHeader) {
+ return NextResponse.json(
+ { success: false, error: "Payment header is required" },
+ { status: 400 },
+ );
+ }
+
+ // Decode the payment header
+ const decodedPayment = exact.evm.decodePayment(paymentHeader);
+
+ const facilitatorUrl =
+ process.env.NEXT_PUBLIC_FACILITATOR_URL ||
+ "https://www.x402.org/facilitator";
+
+ // Call facilitator to verify
+ const verifyResponse = await fetch(`${facilitatorUrl}/verify`, {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({
+ paymentPayload: decodedPayment,
+ paymentRequirements: PAYMENT_REQUIREMENTS,
+ }),
+ });
+
+ const verifyResult = await verifyResponse.json();
+
+ if (!verifyResult.isValid) {
+ return NextResponse.json(
+ {
+ success: false,
+ x402Version: 1,
+ error: verifyResult.invalidReason || "Payment verification failed",
+ accepts: [PAYMENT_REQUIREMENTS],
+ payer: verifyResult.payer,
+ },
+ { status: 402 }, // Payment Required!
+ );
+ }
+
+ // Call facilitator to settle the payment
+ const settleResponse = await fetch(`${facilitatorUrl}/settle`, {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({
+ paymentPayload: decodedPayment,
+ paymentRequirements: PAYMENT_REQUIREMENTS,
+ }),
+ });
+
+ const settleResult = await settleResponse.json();
+
+ if (!settleResult.success) {
+ return NextResponse.json(
+ {
+ success: false,
+ error: settleResult.errorReason || "Settle failed",
+ },
+ { status: 500 },
+ );
+ }
+
+ // Payment is valid and settled, set the cookie
+ const cookieStore = await cookies();
+ // This should be a JWT signed by the server following best practices for a session token
+ // See: https://nextjs.org/docs/app/guides/authentication#stateless-sessions
+ cookieStore.set("payment-session", paymentHeader, {
+ maxAge: COOKIE_TIMEOUT_SECONDS, // 5 minutes
+ });
+
+ return NextResponse.json(
+ {
+ success: true,
+ payer: verifyResult.payer,
+ },
+ { status: 200 },
+ );
+ } catch (error) {
+ console.error("Error verifying payment:", error);
+ return NextResponse.json(
+ {
+ success: false,
+ x402Version: 1,
+ error: error instanceof Error ? error.message : "Internal server error",
+ accepts: [PAYMENT_REQUIREMENTS],
+ },
+ { status: 500 },
+ );
+ }
+}
diff --git a/examples/with-x402/app/constants.ts b/examples/with-x402/app/constants.ts
new file mode 100644
index 000000000..0cb79c6a1
--- /dev/null
+++ b/examples/with-x402/app/constants.ts
@@ -0,0 +1,22 @@
+// USDC address on Base Sepolia
+export const USDC_ADDRESS = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
+
+// 0.01 USDC (6 decimals)
+export const PAYMENT_AMOUNT = "10000";
+
+// Cookie timeout
+export const COOKIE_TIMEOUT_SECONDS = 300;
+
+// Payment requirements
+export const PAYMENT_REQUIREMENTS = {
+ scheme: "exact" as const,
+ network: "base-sepolia" as const,
+ maxAmountRequired: PAYMENT_AMOUNT, // 0.01 USDC
+ resource: "http://example.com/",
+ description: "Access to protected content",
+ mimeType: "text/html",
+ payTo: process.env.NEXT_PUBLIC_RESOURCE_WALLET_ADDRESS!,
+ maxTimeoutSeconds: COOKIE_TIMEOUT_SECONDS,
+ asset: USDC_ADDRESS, // USDC on Base Sepolia
+ extra: { name: "USDC", version: "2" },
+};
diff --git a/examples/with-x402/app/globals.css b/examples/with-x402/app/globals.css
new file mode 100644
index 000000000..bd80c9f5a
--- /dev/null
+++ b/examples/with-x402/app/globals.css
@@ -0,0 +1,42 @@
+@import "tailwindcss";
+
+@font-face {
+ font-family: "Inter";
+ font-style: normal;
+ font-weight: 400;
+ font-display: swap;
+ src: url("/fonts/inter/Inter-Regular.woff2?v=3.19") format("woff2");
+}
+
+@font-face {
+ font-family: "Inter";
+ font-style: normal;
+ font-weight: 600;
+ font-display: swap;
+ src: url("/fonts/inter/Inter-SemiBold.woff2?v=3.19") format("woff2");
+}
+
+* {
+ font-family:
+ "Inter",
+ -apple-system,
+ BlinkMacSystemFont,
+ sans-serif;
+}
+
+:root {
+ font-family:
+ "Inter",
+ -apple-system,
+ BlinkMacSystemFont,
+ sans-serif;
+}
+
+button {
+ cursor: pointer;
+ transition: transform 0.1s ease;
+}
+
+button:active {
+ transform: scale(0.95);
+}
diff --git a/examples/with-x402/app/layout.tsx b/examples/with-x402/app/layout.tsx
new file mode 100644
index 000000000..10f23d7bf
--- /dev/null
+++ b/examples/with-x402/app/layout.tsx
@@ -0,0 +1,66 @@
+"use client";
+
+import { Geist, Geist_Mono } from "next/font/google";
+import "./globals.css";
+import { CreateSubOrgParams, TurnkeyProvider } from "@turnkey/react-wallet-kit";
+import "@turnkey/react-wallet-kit/styles.css";
+
+const geistSans = Geist({
+ variable: "--font-geist-sans",
+ subsets: ["latin"],
+});
+
+const geistMono = Geist_Mono({
+ variable: "--font-geist-mono",
+ subsets: ["latin"],
+});
+
+const createSubOrgParams: CreateSubOrgParams = {
+ customWallet: {
+ walletName: "ETH Wallet",
+ walletAccounts: [
+ {
+ addressFormat: "ADDRESS_FORMAT_ETHEREUM",
+ curve: "CURVE_SECP256K1",
+ pathFormat: "PATH_FORMAT_BIP32",
+ path: "m/44'/60'/0'/0/0",
+ },
+ ],
+ },
+};
+
+export default function RootLayout({
+ children,
+}: Readonly<{
+ children: React.ReactNode;
+}>) {
+ return (
+
+
+ Turnkey x402
+
+
+
+
+ {children}
+
+
+
+ );
+}
diff --git a/examples/with-x402/app/page.tsx b/examples/with-x402/app/page.tsx
new file mode 100644
index 000000000..08efd7295
--- /dev/null
+++ b/examples/with-x402/app/page.tsx
@@ -0,0 +1,30 @@
+import Link from "next/link";
+
+export default function Home() {
+ return (
+
+
+ {/* Hero Section */}
+
+
+
+
+
+
+ A demo showing how to seamlessly integrate Turnkey's embedded
+ wallets with x402 paywalls.
+
+
+
+ Start demo
+
+
+
+
+
+
+ );
+}
diff --git a/examples/with-x402/app/paywall/page.tsx b/examples/with-x402/app/paywall/page.tsx
new file mode 100644
index 000000000..e167a0c80
--- /dev/null
+++ b/examples/with-x402/app/paywall/page.tsx
@@ -0,0 +1,278 @@
+"use client";
+
+import { AuthState, ClientState, useTurnkey } from "@turnkey/react-wallet-kit";
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { createAccount } from "@turnkey/viem";
+import { createWalletClient, http, sha256, type Account } from "viem";
+import { baseSepolia } from "viem/chains";
+import { exact } from "x402/schemes";
+import { PAYMENT_AMOUNT, USDC_ADDRESS } from "../constants";
+
+export default function PaymentClient() {
+ const {
+ authState,
+ clientState,
+ user,
+ session,
+ wallets,
+ httpClient, // @turnkey/viem needs a Turnkey HTTP client to access the Turnkey API
+ handleLogin,
+ logout,
+ } = useTurnkey();
+
+ const [loading, setLoading] = useState(false);
+ const [error, setError] = useState(null);
+ const router = useRouter();
+
+ const walletAddress = wallets[0]?.accounts[0]?.address;
+ const organizationId = session?.organizationId;
+
+ // The signing code below creates an EIP-3009 TransferWithAuthorization signature using Turnkey's Viem integration.
+ // This signature is then encoded into an x402 payment header which is sent to the server for verification and settlement.
+ // If the payment is successful, a cookie is set by the server allowing access to the protected content.
+ const handlePayment = async () => {
+ if (
+ authState !== AuthState.Authenticated ||
+ !wallets ||
+ wallets.length === 0
+ ) {
+ setError("Please sign in first");
+ return;
+ }
+
+ setLoading(true);
+ setError(null);
+
+ try {
+ // This code was adapted from Turnkey's with-viem example. See examples/with-viem/src/eip712/erc3009_transfer.ts for the example.
+
+ // Create Turnkey Viem account
+ const turnkeyAccount = await createAccount({
+ client: httpClient!,
+ organizationId: organizationId!,
+ signWith: walletAddress,
+ ethereumAddress: walletAddress,
+ });
+
+ // Create Viem wallet client
+ const client = createWalletClient({
+ account: turnkeyAccount as Account,
+ chain: baseSepolia,
+ transport: http(),
+ });
+
+ // Define EIP-712 domain for USDC on Base Sepolia
+ const domain = {
+ name: "USDC",
+ version: "2",
+ chainId: baseSepolia.id,
+ verifyingContract: USDC_ADDRESS as `0x${string}`,
+ } as const;
+
+ // Define the types for EIP-3009 TransferWithAuthorization
+ const types = {
+ TransferWithAuthorization: [
+ { name: "from", type: "address" },
+ { name: "to", type: "address" },
+ { name: "value", type: "uint256" },
+ { name: "validAfter", type: "uint256" },
+ { name: "validBefore", type: "uint256" },
+ { name: "nonce", type: "bytes32" },
+ ],
+ } as const;
+
+ // Generate a random nonce
+ const nonce = sha256(crypto.getRandomValues(new Uint8Array(32)));
+
+ // Set validity period (valid for 5 minutes from now)
+ const validAfter = BigInt(0);
+ const validBefore = BigInt(Math.floor(Date.now() / 1000) + 300);
+
+ // Get the payTo address from environment or use a default
+ const payToAddress =
+ process.env.NEXT_PUBLIC_RESOURCE_WALLET_ADDRESS ||
+ "0x0000000000000000000000000000000000000000";
+
+ // Create the message
+ const message = {
+ from: walletAddress as `0x${string}`,
+ to: payToAddress as `0x${string}`,
+ value: BigInt(PAYMENT_AMOUNT),
+ validAfter,
+ validBefore,
+ nonce,
+ };
+
+ // Sign the typed data using Turnkey
+ const signature = await client.signTypedData({
+ account: turnkeyAccount as Account,
+ domain,
+ types,
+ primaryType: "TransferWithAuthorization",
+ message,
+ });
+
+ console.log("Signature:", signature);
+
+ // Encode the payment using x402
+ const encodedPayment = exact.evm.encodePayment({
+ scheme: "exact",
+ network: "base-sepolia",
+ x402Version: 1,
+ payload: {
+ signature,
+ authorization: {
+ from: walletAddress,
+ to: payToAddress,
+ value: PAYMENT_AMOUNT,
+ validAfter: validAfter.toString(),
+ validBefore: validBefore.toString(),
+ nonce,
+ },
+ },
+ });
+
+ // Fetch the server route to verify payment using the facilitator. If successful, a cookie will be set indicating that payment has been made.
+ const result = await fetch("/api/verify-payment", {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({ paymentHeader: encodedPayment }),
+ });
+
+ if (result.status === 200) {
+ // Payment successful, redirect to protected content. By now, the server has set a cookie so the middleware will allow us to access the protected route.
+ router.push("/protected");
+ } else if (!result?.ok) {
+ const data = await result.json();
+ throw new Error(data.error);
+ }
+ } catch (err) {
+ console.error("Payment error:", err);
+ setError(
+ err instanceof Error ? err.message : "Failed to process payment",
+ );
+ } finally {
+ setLoading(false);
+ }
+ };
+
+ return (
+
+ {clientState === ClientState.Error && (
+
+ Something went wrong, try reloading the page. Did you set your .env
+ vars correctly?
+
+ You used a Turnkey embedded wallet to pay for this page! You
+ will be able to access this page for 5 minutes. If you want to clear
+ your token before then, click the button below.
+
+ 
+