@agenttx/sdk

TypeScript client for AgentTX V0.2.1. It exposes low-level spend APIs and controlledFetch(), which handles an x402 challenge, requests an AgentTX authorization, executes the payment, waits for its receipt, and returns the purchased resource as a standard Response.

The public sandbox base URL is https://control.agenttx.cc. Its readiness and Worker health endpoints are public, but using the Control API still requires an Agent credential created in an authenticated AgentTX workspace. V0.2.1 remains sandbox-only and cannot move real funds.

Create an Agent in the authenticated console and copy its one-time opaque atx_agent_* credential into a server-side secret store. Also retain the workspace organization ID. This credential is not a JWT. Never put it in browser code, email, logs, GitHub issues, or forum posts.

import { AgentTX } from "@agenttx/sdk";

const agenttx = new AgentTX({
  baseUrl: process.env.AGENTTX_API_URL!,
  credential: process.env.AGENTTX_AGENT_SECRET!,
  organizationId: process.env.AGENTTX_ORGANIZATION_ID!,
});

const response = await agenttx.controlledFetch(
  process.env.AGENTTX_X402_DEMO_URL!,
  {},
  { purpose: "market_research", category: "data" },
);
console.log(await response.json());

The client supplies the Bearer credential and X-AgentTX-Organization-Id routing header. It also creates an idempotency key, nonce, and timestamp for every write. The organization ID is not authorization: the credential is authenticated inside that tenant's database isolation scope.

The default sandbox policy may return APPROVAL_REQUIRED. Approve the same spend intent in the console, then resume it without creating a duplicate:

const approved = await agenttx.waitForAuthorization(spendIntentId);
if (approved.status === "AUTHORIZED") {
  const response = await agenttx.resumeControlledFetch(spendIntentId);
}

HTTP 429 may come from the source-IP edge limit or the authenticated tenant's durable request quota. AgentTXError.retryAfterMs exposes Retry-After when the server or gateway supplies it. APPROVAL_REQUIRED and DENIED are policy outcomes; do not retry them as transient failures or bypass the control plane.