@veilnet/stealth-x402

VeilNet private settlement for x402. Drop-in stealth-address payTo for any x402 endpoint — every payment lands at a fresh one-time address, so the on-chain payment graph (who earned what, who paid whom, repeat-customer links) is unlinkable. The buyer side and the facilitator are unchanged: a stealth address is just an address, and any x402 facilitator settles it like a normal USDC transfer.

Standards: EIP-5564 + ERC-6538 (stealth addresses), EIP-3009 (gasless USDC), x402 (HTTP payments). Proven on Base mainnet.

Install

npm install @veilnet/stealth-x402

Three pieces

import {
  createVeilnetIdentity,
  createStealthSettlement,
  createStealthScanner,
} from "@veilnet/stealth-x402";

// 1. One-time per recipient — publish only the meta-address.
const { metaAddress } = createVeilnetIdentity(seedHex);

// 2. Mint stealth challenges + verify/settle payments.
const veilnet = createStealthSettlement({ rpcUrl, relayerKey, facilitatorUrl });
const server = veilnet.serverForRecipient(metaAddress, priceAtomic);
const challenge = await server.challenge({ resource, priceAtomic });
// → challenge.announcement.stealthAddress is the fresh payTo
const result = await server.verify({ signedPayload, challenge });

// 3. Detect settled payments and sweep them to a treasury.
const scanner = createStealthScanner({ rpcUrl, relayerKey, seedHex, startBlock });
for await (const p of scanner.detect()) await scanner.sweep(p, treasury);

What does NOT change

• The buyer's x402 client — pays a stealth payTo exactly like any address.
• The facilitator — keep Coinbase CDP or use VeilNet's; the SDK adapts the request shape.
• The on-chain USDC amount — public as always. Stealth hides who/whom, not how much.

See the full integration guide for a step-by-step server wiring (challenge → cache → verify → sweep).