Agents that can pay, can be trusted and can be stopped. Each one is identified by ENS, remembered on Arkiv and paid on Whitechain: decentralized, secure and verifiable, on testnets only.
ENS on Ethereum Sepolia
Every person, agent and shop has a name under graphpay.eth, for example payer.vitalik.graphpay.eth. The owner can pause an agent with one text record or unregister it, and every payment checks the name first. A shop’s address record says where its money goes.
x402 on Whitechain Sepolia
The shop asks for payment with HTTP 402. The payer agent signs the order’s terms and pays no gas; our own facilitator checks the signature and the ENS name, and its relayer settles in test USDT and pays the gas. An on-chain policy caps what each agent can spend in a day.
Graph Arkiv on Arkiv Rabdi
Every payment, refund and delivery becomes a line between two ENS names, with running tallies per name. The receipts cannot be edited. Any agent can ask the graph in one GraphQL query and see every Arkiv read behind the answer before it pays.
State lives on the Whitechain contract and on Arkiv; the website only runs code. No personal data is collected and nothing identifies a visitor. The city of shops around the demo is synthetic and labelled as such.
Every route that makes anyone sign runs on the server behind the demo passcode, sent in a header and never in a URL.
| Route | Gate | What it does | Who signs |
|---|---|---|---|
| POST /api/agents/run | passcode | start one errand (one at a time) and stream its events (SSE) | the payer agent, then the relayer |
| GET /api/agents/run/:id/events | open | replay a run held by this server (best effort; the POST streams it live) | nobody |
| GET /api/state/customer | open | the payer agent's status, cap, spend, last order, subscription | nobody |
| POST /api/customer/reorder | passcode | re-order from the same shop | the payer agent, then the relayer |
| POST /api/customer/refund-request | passcode | record a refund request on Arkiv | the recorder (W_SYNC) |
| POST /api/customer/subscribe | passcode | subscribe to the weekly box (or the demo period) | the payer agent, then the relayer |
| POST /api/customer/unsubscribe | passcode | cancel the subscription | the payer agent, then the relayer |
| POST /api/customer/pause | passcode | set the payer agent's ENS status to paused | the owner (Sepolia) |
| POST /api/customer/resume | passcode | set the payer agent's ENS status back to active | the owner (Sepolia) |
| POST /api/customer/kill-disposable | passcode | provision, pay with and unregister a disposable agent | the owner, the disposable agent, the relayer |
| GET /api/merchant/events | open | stream the shop's new edges (SSE, polled from GraphQL) | nobody |
| POST /api/merchant/dispatch | passcode | mark the order delivered | the merchant |
| POST /api/merchant/open | passcode | list the shop as open on Arkiv (renewed every 5 min while on) or take it off | W_DIRECTORY (Arkiv) |
| POST /api/merchant/refund | passcode | partial or full refund | the merchant |
| GET /api/merchant/export.csv | open | the accountant's CSV from GraphQL | nobody |
| GET /api/race | rate limit | one side of the race, live and uncached (SSE) | nobody |
| GET /api/map | open | the shop directory, open shops and agents at work, from the graph | nobody |
| GET /api/status | open | block heads, mirror lag, relayer balance, token mode | nobody |
| POST /api/passcode | passcode | check the passcode (signs nothing) | nobody |
A short drop-in checkout lets any shop take these payments; the demo store adds it in about 20 lines. It is shown here when it ships.