Agents
Deploy from CI without stored secrets.
Conventional CI deployment needs a stored deploy token — a long-lived API key sitting in your CI secrets, waiting to leak or expire. With x402-hosting there is no API key at all: the CLI pays per operation in USDC over the x402 protocol, so the credential is a wallet payment, not a stored secret. A redeploy costs $0.01.
The problem with deploy tokens
A typical CI pipeline deploys with a platform API key stored as a secret. That key is powerful — it often controls every project on the account — and it is persistent, so a leak in a log or a compromised CI provider exposes everything until someone rotates it. Rotation itself is manual work. The whole arrangement exists only because the platform needs to authenticate a caller it cannot otherwise identify.
Payment as the credential
x402 replaces authentication with settlement. Each paid operation is an HTTP 402 challenge that the pipeline's wallet signs. There is no bearer token, OAuth app, or password anywhere in the CI configuration. Authorization is also narrow by construction: the wallet that paid a project's first upload owns it, and mutations from any other wallet are rejected with wallet_not_owner. A CI wallet controls exactly the projects it paid for — nothing more.
A CI wallet with --payer env
The --payer flag selects how the CLI pays. For CI, env mode reads wallet credentials from environment variables, so the pipeline signs challenges non-interactively:
$ npx x402-hosting@latest deploy --days 30 --payer env
Other modes fit other setups: auto is the default for local use, awal uses the awal agentic wallet CLI, and external with a --payer-cmd template hands each challenge to a payer process outside the CI job entirely. --payer and --payer-cmd are mutually exclusive.
Failed runs cost nothing
The CLI builds the project locally with OpenNext before any payment is requested. A CI run that fails at build time never sees a 402 challenge, so it costs nothing — no partial charges, no cleanup. When the build succeeds, the pipeline pays $0.01 for a redeploy at the same URL, or $0.01 upload plus $0.20 per project-day for a first deploy.
Reconciling interrupted runs
CI jobs get cancelled: runners are killed, networks drop. If a run is interrupted after a payment settles, the operation is not lost — the next run calls finalize to reconcile the pending operation before attempting another payment, preventing duplicate charges and duplicate deployments.
CI deployment, summarized
- No deploy token, API key, or password in CI secrets
- --payer env signs challenges from a CI wallet
- wallet_not_owner confines the CI wallet to its own projects
- Local build failures cost nothing
- finalize reconciles interrupted runs before retrying