npx skills add https://github.com/okx/onchainos-skills --skill okx-x402-payment签署 x402 支付授权并返回支付凭证,用于访问需要付费的资源。支持 TEE 签名(通过钱包会话)或本地签名(使用用户自己的私钥)。
每次运行任何 onchainos 命令之前,请始终按顺序执行以下步骤。不要向用户回显常规命令输出;仅在安装、更新或处理失败时提供简短的状态更新。
解析最新稳定版本 :从 GitHub API 获取最新的稳定发布标签:
curl -sSL "https://api.github.com/repos/okx/onchainos-skills/releases/latest"
将 tag_name 字段(例如 v1.0.5)提取到 LATEST_TAG 中。如果 API 调用失败且 onchainos 已在本地安装,则跳过步骤 2-3 并继续运行命令(用户可能离线或被限速;使用过时的二进制文件总比阻塞好)。如果 onchainos 未安装,停止并告知用户检查网络连接或从 手动安装。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
安装或更新 :如果未找到 onchainos,或者缓存文件 ~/.onchainos/last_check(Windows 上为 $env:USERPROFILE\.onchainos\last_check)超过 12 小时:
curl -sSL "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" -o /tmp/onchainos-install.sh curl -sSL "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -o /tmp/installer-checksums.txtInvoke-WebRequest -Uri "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.ps1" -OutFile "$env:TEMP\onchainos-install.ps1" Invoke-WebRequest -Uri "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -OutFile "$env:TEMP\installer-checksums.txt"installer-checksums.txt 验证安装程序的 SHA256。如果不匹配,停止并发出警告——安装程序可能已被篡改。sh /tmp/onchainos-install.sh(或在 Windows 上执行 & "$env:TEMP\onchainos-install.ps1")。安装程序内部处理版本比较,仅在需要时下载二进制文件。验证二进制文件完整性(每个会话一次):运行 onchainos --version 获取已安装版本(例如 1.0.5 或 2.0.0-beta.0)。将已安装的标签构造为 v<version>。下载已安装版本标签(不一定是 LATEST_TAG)的 checksums.txt:curl -sSL "https://github.com/okx/onchainos-skills/releases/download/v<version>/checksums.txt" -o /tmp/onchainos-checksums.txt 查找平台目标,并将已安装二进制文件的 SHA256 与校验和进行比较。如果不匹配,重新安装(步骤 2)并重新验证。如果仍然不匹配,停止并发出警告。
arm64->aarch64-apple-darwin, x86_64->; Linux: ->, ->, ->, ->; Windows: ->, ->, ->检查技能版本漂移(每个会话一次):如果 onchainos --version 比此技能的 metadata.version 新,则显示一次性通知,提示该技能可能已过时,并建议用户通过其平台的方法重新安装技能。不要阻塞。
命令失败时不要自动重新安装。 报告错误并建议运行 onchainos --version 或从 https://github.com/okx/onchainos-skills 手动重新安装。
速率限制错误。 如果命令触发速率限制,共享的 API 密钥可能被限制。建议在 OKX 开发者门户 创建个人密钥。如果用户创建了 .env 文件,提醒他们将其添加到 .gitignore。
okx-agentic-walletokx-wallet-portfoliookx-dex-swapokx-dex-tokenokx-dex-marketokx-dex-signalokx-dex-trenchesokx-onchain-gatewayokx-security--network 使用 CAIP-2 格式:eip155:<realChainIndex>。支持 onchainos wallet chains 返回的所有 EVM 链。链列表中的 realChainIndex 字段对应于 CAIP-2 标识符的 <chainId> 部分。
常见示例:
| 链 | 网络标识符 |
|---|---|
| Ethereum | eip155:1 |
| X Layer | eip155:196 |
| Base | eip155:8453 |
| Arbitrum One | eip155:42161 |
| Linea | eip155:59144 |
要获取支持的 EVM 链及其 realChainIndex 的完整列表,请运行:
onchainos wallet chains
x402 支付不支持非 EVM 链(例如 Solana、Tron、Ton、Sui)——仅接受
eip155:*标识符。
x402 是一种 HTTP 支付协议。当服务器返回 HTTP 402 Payment Required 时,它会包含一个 base64 编码的 JSON 负载,描述所需的支付内容。完整流程如下:
HTTP 402accepts[0] 中提取支付参数onchainos payment x402-pay → 获取 { signature, authorization }此技能端到端地拥有步骤 2–4。
# 为 X Layer 上 USDG 付费资源签署 x402 支付
onchainos payment x402-pay \
--network eip155:196 \
--amount 1000000 \
--pay-to 0xRecipientAddress \
--asset 0x4ae46a509f6b1d9056937ba4500cb143933d2dc8 \
--max-timeout-seconds 300
---|---|---
1 | onchainos payment x402-pay | 签署 x402 支付并返回支付凭证
发送用户请求的 HTTP 请求。如果响应状态不是 402,直接返回结果——无需支付,不要检查钱包或尝试登录。
重要:发送请求前不要检查钱包状态或尝试登录。仅当响应是 HTTP 402 时才继续执行支付步骤。
如果响应是 HTTP 402,其正文是一个 base64 编码的 JSON 字符串。解码它:
rawBody = response.body // base64 字符串
decoded = JSON.parse(atob(rawBody))
option = decoded.accepts[0]
从 option 中提取以下字段:
| x402 字段 | CLI 参数 | 备注 |
|---|---|---|
option.network | --network | CAIP-2 格式,例如 eip155:196 |
option.amount 或 option.maxAmountRequired | --amount | 优先使用 amount;回退到 maxAmountRequired |
option.payTo | --pay-to | |
option.asset | --asset | 代币合约地址 |
option.maxTimeoutSeconds | --max-timeout-seconds | 可选,默认 300 |
⚠️ 强制要求:显示支付详情并暂停,等待用户确认。在用户明确确认之前,不要检查钱包状态、运行 onchainos wallet status、尝试登录或调用任何其他工具。
向用户呈现以下信息:
此资源需要 x402 支付:
- 网络 :
<链名称>(<网络>)- 代币 :
<代币符号>(<资产>)- 金额 :
<人类可读金额>(使用代币小数位数从最小单位转换)- 支付给 :
<payTo>
继续支付吗?(是 / 否)
然后暂停并等待用户的响应。不要在同一个回合中继续。
既然需要支付,检查用户是否有钱包会话:
onchainos wallet status
"此资源需要支付 (x402)。您需要一个钱包来签署支付。您想创建一个吗?(免费,大约需要 30 秒。)"
onchainos wallet login(AK 登录,无需邮箱)或 onchainos wallet login <邮箱>(OTP 登录),然后继续步骤 4。使用提取的参数运行 onchainos payment x402-pay。返回 { signature, authorization }。
如果签名失败(例如,会话过期、未登录、AK 重新登录失败):
onchainos wallet login 或 onchainos wallet login <邮箱>,然后重试此步骤。根据 decoded.x402Version 确定头部名称:
x402Version >= 2 → PAYMENT-SIGNATUREx402Version < 2(或不存在) → X-PAYMENT构建头部值:
paymentPayload = { ...decoded, payload: { signature, authorization } }
headerValue = btoa(JSON.stringify(paymentPayload))
重放原始请求,并附上头部:
GET/POST <原始-url>
<header-name>: <headerValue>
将最终响应正文返回给用户。
成功支付并收到响应后,建议:
| 刚刚完成 | 建议 |
|---|---|
| 成功重放 | 1. 检查余额影响 → okx-agentic-wallet 2. 向同一资源发起另一个请求 |
| 重放时收到 402(已过期) | 使用新的签名从步骤 4 重试 |
以对话方式呈现,例如:"完成!该资源返回了以下结果。您想检查更新后的余额吗?" —— 永远不要向用户暴露技能名称或内部字段名称。
用户:"获取 https://api.example.com/data —— 它需要 x402 支付"
1. 发送 GET https://api.example.com/data → HTTP 402 附带 base64 负载
↓ 解码负载,提取 accepts[0]
2. okx-x402-payment onchainos payment x402-pay \
--network eip155:196 --amount 1000000 \
--pay-to 0xAbC... \
--asset 0x4ae46a509f6b1d9056937ba4500cb143933d2dc8 → { signature, authorization }
↓ 组装支付头部
3. 使用 PAYMENT-SIGNATURE 头部重放 GET https://api.example.com/data → HTTP 200
数据传递:
accepts[0].network → --networkaccepts[0].amount(或 maxAmountRequired) → --amountaccepts[0].payTo → --pay-toaccepts[0].asset → --asset用户:"访问这个付费 API,然后告诉我我花了多少钱"
1. okx-x402-payment (上述工作流 A) → 支付凭证 + 成功响应
2. okx-agentic-wallet onchainos wallet balance --chain 196 → 支付后的当前余额
用户:"这个 x402 支付安全吗?资产是 0x4ae46a..."
1. okx-security onchainos security token-scan \
--address 0x4ae46a509f6b1d9056937ba4500cb143933d2dc8 \
--chain 196 → 代币风险报告
↓ 如果安全
2. okx-x402-payment (上述工作流 A) → 签名并支付
签署 x402 支付并返回 EIP-3009 支付凭证。
onchainos payment x402-pay \
--network <network> \
--amount <amount> \
--pay-to <address> \
--asset <address> \
[--from <address>] \
[--max-timeout-seconds <seconds>]
| 参数 | 必需 | 默认值 | 描述 |
|---|---|---|---|
--network | 是 | - | CAIP-2 网络标识符(例如,X Layer 为 eip155:196,Ethereum 为 eip155:1) |
--amount | 是 | - | 以最小单位计的支付金额(例如,1000000 = 1 USDG,6 位小数) |
--pay-to | 是 | - | 收款人地址(来自 x402 的 payTo 字段) |
--asset | 是 | - | 代币合约地址(来自 x402 的 asset 字段) |
--from | 否 | 选定的账户 | 付款人地址;如果省略,则使用当前选定的账户 |
--max-timeout-seconds | 否 | 300 | 授权有效期窗口(秒) |
返回字段:
| 字段 | 类型 | 描述 |
|---|---|---|
signature | 字符串 | EIP-3009 secp256k1 签名(65 字节,r+s+v,十六进制),由 TEE 后端返回 |
authorization | 对象 | 标准 x402 EIP-3009 transferWithAuthorization 参数 |
authorization.from | 字符串 | 付款人钱包地址 |
authorization.to | 字符串 | 收款人地址(= payTo) |
authorization.value | 字符串 | 以最小单位计的支付金额(= 来自 402 负载的 amount 或 maxAmountRequired) |
authorization.validAfter | 字符串 | 授权生效时间戳(Unix 秒) |
authorization.validBefore | 字符串 | 授权失效时间戳(Unix 秒) |
authorization.nonce | 字符串 | 随机数(十六进制,32 字节),防止重放攻击 |
用户说: "获取 https://api.example.com/data —— 它需要 x402 支付"
步骤 1 — 原始请求返回 402:
HTTP 402
正文: "eyJ4NDAyVmVyc2lvbiI6MiwiYWNjZXB0cyI6W3s..." ← base64
解码后的负载:
{
"x402Version": 2,
"accepts": [{
"network": "eip155:196",
"amount": "1000000",
"payTo": "0xAbC...",
"asset": "0x4ae46a509f6b1d9056937ba4500cb143933d2dc8",
"maxTimeoutSeconds": 300
}]
}
步骤 3–4 — 检查钱包 + 签名:
onchainos payment x402-pay \
--network eip155:196 \
--amount 1000000 \
--pay-to 0xAbC... \
--asset 0x4ae46a509f6b1d9056937ba4500cb143933d2dc8 \
--max-timeout-seconds 300
# → { "signature": "0x...", "authorization": { ... } }
步骤 5 — 组装头部并重放:
paymentPayload = { ...decoded, payload: { signature, authorization } }
headerValue = btoa(JSON.stringify(paymentPayload))
GET https://api.example.com/data
PAYMENT-SIGNATURE: <headerValue>
→ HTTP 200 { "result": "..." }
如果用户没有钱包且选择不创建,则引导他们使用自己的私钥进行本地 EIP-3009 签名。
.env 文件中、硬件钱包中或 MetaMask 导出)asset 代币的 ERC-20 余额asset 代币合约必须支持 EIP-3009 transferWithAuthorization与主流程相同 — 解码 base64 正文并提取 accepts[0]:
rawBody = response.body
decoded = JSON.parse(atob(rawBody))
option = decoded.accepts[0]
提取:network、amount(或 maxAmountRequired)、payTo、asset、maxTimeoutSeconds。
构建 TransferWithAuthorization 消息并使用 eth_signTypedData_v4 签名。关键字段:
| 字段 | 值 |
|---|---|
from | 付款人地址 |
to | option.payTo |
value | option.amount |
validAfter | "0" |
validBefore | now + maxTimeoutSeconds(Unix 秒) |
nonce | 随机 32 字节(十六进制) |
EIP-712 域:查询代币合约的 name()、version(通常是 "1" 或 "2")、来自 CAIP-2 网络的 chainId,以及 verifyingContract = option.asset。
使用 ethers.js 签名:
const wallet = new ethers.Wallet('<PRIVATE_KEY>');
const signature = await wallet.signTypedData(domain, types, message);
完整的类型化数据规范请参见 EIP-3009。
domain.name/version因代币而异(例如 USDC 使用"USD Coin"/"2")—— 查询合约以确认。
与主流程步骤 5 相同 — 根据已签名字段构建 authorization,根据 x402Version 确定头部名称,组装 paymentPayload = { ...decoded, payload: { signature, authorization } },进行 base64 编码,并附上支付头部重放原始请求。
nonce 必须是随机的 32 字节十六进制值;重用 nonce 将导致交易被拒绝validBefore 是 Unix 时间戳(秒) — 将其设置为 now + maxTimeoutSeconds(默认 300 秒 / 5 分钟)version 字符串),签名将无效 — 务必先查询合约(from, to, value, nonce) 元组 — 它不能被修改或重用onchainos wallet login 或 onchainos wallet login <邮箱>)。如果不想,则引导他们使用上述的本地签名备用方案eip155:<chainId> 格式的 EVM 链--amount 必须是最小单位 — 提醒用户进行转换(例如,1 USDG = 1000000,6 位小数)--amount 始终是最小单位(例如,1 USDG 为 1000000)10^decimal1.00 USDG)onchainos payment x402-pay):需要经过身份验证的 JWT 会话;签名在 TEE 内部执行 — 私钥永不离开安全飞地--network 必须是 CAIP-2 格式:eip155:<chainId>(例如 eip155:1、eip155:8453、eip155:196)authorization 对象在构建支付头部时必须与 signature 一起包含每周安装次数
378
代码仓库
GitHub 星标数
173
首次出现
5 天前
安全审计
安装于
codex367
opencode366
github-copilot365
gemini-cli364
cursor364
kimi-cli363
Sign an x402 payment authorization and return the payment proof for accessing payment-gated resources. Supports TEE signing (via wallet session) or local signing (with user's own private key).
Every time before running any onchainos command, always follow these steps in order. Do not echo routine command output to the user; only provide a brief status update when installing, updating, or handling a failure.
Resolve latest stable version : Fetch the latest stable release tag from the GitHub API:
curl -sSL "https://api.github.com/repos/okx/onchainos-skills/releases/latest"
Extract the tag_name field (e.g., v1.0.5) into LATEST_TAG. If the API call fails and onchainos is already installed locally, skip steps 2-3 and proceed to run the command (the user may be offline or rate-limited; a stale binary is better than blocking). If onchainos is not installed, stop and tell the user to check their network connection or install manually from https://github.com/okx/onchainos-skills.
Install or update : If onchainos is not found, or if the cache at ~/.onchainos/last_check ($env:USERPROFILE\.onchainos\last_check on Windows) is older than 12 hours:
curl -sSL "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" -o /tmp/onchainos-install.sh curl -sSL "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -o /tmp/installer-checksums.txtInvoke-WebRequest -Uri "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.ps1" -OutFile "$env:TEMP\onchainos-install.ps1" okx-agentic-walletokx-wallet-portfoliookx-dex-swapokx-dex-tokenokx-dex-marketokx-dex-signalokx-dex-trenchesokx-onchain-gateway--network uses CAIP-2 format: eip155:<realChainIndex>. All EVM chains returned by onchainos wallet chains are supported. The realChainIndex field in the chain list corresponds to the <chainId> portion of the CAIP-2 identifier.
Common examples:
| Chain | Network Identifier |
|---|---|
| Ethereum | eip155:1 |
| X Layer | eip155:196 |
| Base | eip155:8453 |
| Arbitrum One | eip155:42161 |
| Linea | eip155:59144 |
For the full list of supported EVM chains and their realChainIndex, run:
onchainos wallet chains
Non-EVM chains (e.g., Solana, Tron, Ton, Sui) are not supported by x402 payment — only
eip155:*identifiers are accepted.
x402 is an HTTP payment protocol. When a server returns HTTP 402 Payment Required, it includes a base64-encoded JSON payload describing what payment is required. The full flow is:
HTTP 402 with base64-encoded payment payloadaccepts[0]onchainos payment x402-pay → obtain { signature, authorization }This skill owns steps 2–4 end to end.
# Sign an x402 payment for an X Layer USDG-gated resource
onchainos payment x402-pay \
--network eip155:196 \
--amount 1000000 \
--pay-to 0xRecipientAddress \
--asset 0x4ae46a509f6b1d9056937ba4500cb143933d2dc8 \
--max-timeout-seconds 300
---|---|---
1 | onchainos payment x402-pay | Sign an x402 payment and return the payment proof
Make the HTTP request the user asked for. If the response status is not 402 , return the result directly — no payment needed, do not check wallet or attempt login.
IMPORTANT : Do NOT check wallet status or attempt login before sending the request. Only proceed to payment steps if the response is HTTP 402.
If the response is HTTP 402, the body is a base64-encoded JSON string. Decode it:
rawBody = response.body // base64 string
decoded = JSON.parse(atob(rawBody))
option = decoded.accepts[0]
Extract these fields from option:
| x402 field | CLI param | Notes |
|---|---|---|
option.network | --network | CAIP-2 format, e.g. eip155:196 |
option.amount or option.maxAmountRequired | --amount | prefer amount; fall back to maxAmountRequired |
⚠️ MANDATORY: Display payment details and STOP to wait for user confirmation. Do NOT check wallet status, runonchainos wallet status, attempt login, or call any other tool until the user explicitly confirms.
Present the following information to the user:
This resource requires x402 payment:
- Network :
<chain name>(<network>)- Token :
<token symbol>(<asset>)- Amount :
<human-readable amount>(convert from minimal units using token decimals)- Pay to :
<payTo>
Proceed with payment? (yes / no)
Then STOP and wait for the user's response. Do not proceed in the same turn.
Now that payment is required, check if the user has a wallet session:
onchainos wallet status
"This resource requires payment (x402). You need a wallet to sign the payment. Would you like to create one? (It's free and takes ~30 seconds.)"
onchainos wallet login (AK login, no email) or onchainos wallet login <email> (OTP login), then proceed to Step 4.Run onchainos payment x402-pay with the extracted parameters. Returns { signature, authorization }.
If signing fails (e.g., session expired, not logged in, AK re-login failed):
onchainos wallet login or onchainos wallet login <email>, then retry this step.Determine header name from decoded.x402Version:
x402Version >= 2 → PAYMENT-SIGNATUREx402Version < 2 (or absent) → X-PAYMENTBuild header value :
paymentPayload = { ...decoded, payload: { signature, authorization } }
headerValue = btoa(JSON.stringify(paymentPayload))
Replay the original request with the header attached:
GET/POST <original-url>
<header-name>: <headerValue>
Return the final response body to the user.
After a successful payment and response, suggest:
| Just completed | Suggest |
|---|---|
| Successful replay | 1. Check balance impact → okx-agentic-wallet 2. Make another request to the same resource |
| 402 on replay (expired) | Retry from Step 4 with a fresh signature |
Present conversationally, e.g.: "Done! The resource returned the following result. Would you like to check your updated balance?" — never expose skill names or internal field names to the user.
User: "Fetch https://api.example.com/data — it requires x402 payment"
1. Send GET https://api.example.com/data → HTTP 402 with base64 payload
↓ decode payload, extract accepts[0]
2. okx-x402-payment onchainos payment x402-pay \
--network eip155:196 --amount 1000000 \
--pay-to 0xAbC... \
--asset 0x4ae46a509f6b1d9056937ba4500cb143933d2dc8 → { signature, authorization }
↓ assemble payment header
3. Replay GET https://api.example.com/data with PAYMENT-SIGNATURE header → HTTP 200
Data handoff :
accepts[0].network → --networkaccepts[0].amount (or maxAmountRequired) → --amountaccepts[0].payTo → --pay-toaccepts[0].asset → --assetUser: "Access this paid API, then show me how much I spent"
1. okx-x402-payment (Workflow A above) → payment proof + successful response
2. okx-agentic-wallet onchainos wallet balance --chain 196 → current balance after payment
User: "Is this x402 payment safe? The asset is 0x4ae46a..."
1. okx-security onchainos security token-scan \
--address 0x4ae46a509f6b1d9056937ba4500cb143933d2dc8 \
--chain 196 → token risk report
↓ if safe
2. okx-x402-payment (Workflow A above) → sign and pay
Sign an x402 payment and return the EIP-3009 payment proof.
onchainos payment x402-pay \
--network <network> \
--amount <amount> \
--pay-to <address> \
--asset <address> \
[--from <address>] \
[--max-timeout-seconds <seconds>]
| Param | Required | Default | Description |
|---|---|---|---|
--network | Yes | - | CAIP-2 network identifier (e.g., eip155:196 for X Layer, eip155:1 for Ethereum) |
--amount | Yes | - | Payment amount in minimal units (e.g., 1000000 = 1 USDG with 6 decimals) |
--pay-to | Yes |
Return fields :
| Field | Type | Description |
|---|---|---|
signature | String | EIP-3009 secp256k1 signature (65 bytes, r+s+v, hex) returned by TEE backend |
authorization | Object | Standard x402 EIP-3009 transferWithAuthorization parameters |
authorization.from | String | Payer wallet address |
authorization.to | String | Recipient address (= payTo) |
User says: "Fetch https://api.example.com/data — it requires x402 payment"
Step 1 — original request returns 402:
HTTP 402
Body: "eyJ4NDAyVmVyc2lvbiI6MiwiYWNjZXB0cyI6W3s..." ← base64
Decoded payload:
{
"x402Version": 2,
"accepts": [{
"network": "eip155:196",
"amount": "1000000",
"payTo": "0xAbC...",
"asset": "0x4ae46a509f6b1d9056937ba4500cb143933d2dc8",
"maxTimeoutSeconds": 300
}]
}
Step 3–4 — check wallet + sign:
onchainos payment x402-pay \
--network eip155:196 \
--amount 1000000 \
--pay-to 0xAbC... \
--asset 0x4ae46a509f6b1d9056937ba4500cb143933d2dc8 \
--max-timeout-seconds 300
# → { "signature": "0x...", "authorization": { ... } }
Step 5 — assemble header and replay:
paymentPayload = { ...decoded, payload: { signature, authorization } }
headerValue = btoa(JSON.stringify(paymentPayload))
GET https://api.example.com/data
PAYMENT-SIGNATURE: <headerValue>
→ HTTP 200 { "result": "..." }
If the user does not have a wallet and chooses not to create one, guide them through local EIP-3009 signing with their own private key.
.env file, hardware wallet, or MetaMask export)asset token on the target chainasset token contract must support EIP-3009 transferWithAuthorizationSame as the main flow — decode the base64 body and extract accepts[0]:
rawBody = response.body
decoded = JSON.parse(atob(rawBody))
option = decoded.accepts[0]
Extract: network, amount (or maxAmountRequired), payTo, asset, maxTimeoutSeconds.
Build the TransferWithAuthorization message and sign it with eth_signTypedData_v4. Key fields:
| Field | Value |
|---|---|
from | Payer address |
to | option.payTo |
value | option.amount |
validAfter | "0" |
validBefore |
EIP-712 domain: query the token contract's name(), version (often "1" or "2"), chainId from the CAIP-2 network, and verifyingContract = option.asset.
Sign with ethers.js :
const wallet = new ethers.Wallet('<PRIVATE_KEY>');
const signature = await wallet.signTypedData(domain, types, message);
See EIP-3009 for the full typed data spec.
domain.name/versionvary per token (e.g. USDC uses"USD Coin"/"2") — query the contract to confirm.
Same as the main flow Step 5 — build authorization from the signed fields, determine header name from x402Version, assemble paymentPayload = { ...decoded, payload: { signature, authorization } }, base64-encode, and replay the original request with the payment header attached.
nonce must be a random 32-byte hex value; reusing a nonce will cause the transaction to be rejectedvalidBefore is a Unix timestamp in seconds — set it to now + maxTimeoutSeconds (default 300s / 5 minutes)version string), the signature will be invalid — always query the contract first(from, to, value, nonce) tuple — it cannot be modified or reusedonchainos wallet login or onchainos wallet login <email>). If not, guide them through the Local Signing Fallback aboveeip155:<chainId> format are supported--amount must be in minimal units — remind user to convert (e.g., 1 USDG = 1000000 for 6 decimals)--amount is always in minimal units (e.g., 1000000 for 1 USDG)10^decimal1.00 USDG)onchainos payment x402-pay): requires an authenticated JWT session; signing is performed inside a TEE — the private key never leaves the secure enclave--network must be CAIP-2 format: eip155:<chainId> (e.g., eip155:1, eip155:8453, eip155:196)authorization object must be included alongside signature when building the payment headerWeekly Installs
378
Repository
GitHub Stars
173
First Seen
5 days ago
Security Audits
Gen Agent Trust HubFailSocketPassSnykFail
Installed on
codex367
opencode366
github-copilot365
gemini-cli364
cursor364
kimi-cli363
Better Auth 身份验证技能指南:为 TypeScript/JavaScript 应用添加认证
11,500 周安装
Expo应用设计指南:使用Expo Router和NativeWind构建跨平台React Native移动应用
359 周安装
OpenAI Agents SDK:构建文本/语音AI智能体、多智能体工作流与防护栏应用
359 周安装
MCP Lark 飞书集成指南:配置环境变量、调用工具与 mcporter 使用教程
360 周安装
skill-creator:基于API/Git的开发者工具,高效创建与管理技能项目
360 周安装
深度研究技能:AI辅助网络研究方法论,提升内容质量与信息全面性
360 周安装
短视频脚本生成器:AI 驱动,按平台和时长优化,提升视频互动与转化率
360 周安装
x86_64-apple-darwinx86_64x86_64-unknown-linux-gnuaarch64aarch64-unknown-linux-gnui686i686-unknown-linux-gnuarmv7larmv7-unknown-linux-gnueabihfAMD64x86_64-pc-windows-msvcx86i686-pc-windows-msvcARM64aarch64-pc-windows-msvcshasum -a 256 ~/.local/bin/onchainos; Windows: (Get-FileHash "$env:USERPROFILE\.local\bin\onchainos.exe" -Algorithm SHA256).Hash.ToLower()Invoke-WebRequest -Uri "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -OutFile "$env:TEMP\installer-checksums.txt"installer-checksums.txt. On mismatch, stop and warn — the installer may have been tampered with.sh /tmp/onchainos-install.sh (or & "$env:TEMP\onchainos-install.ps1" on Windows). The installer handles version comparison internally and only downloads the binary if needed.Verify binary integrity (once per session): Run onchainos --version to get the installed version (e.g., 1.0.5 or 2.0.0-beta.0). Construct the installed tag as v<version>. Download checksums.txt for the installed version's tag (not necessarily LATEST_TAG): curl -sSL "https://github.com/okx/onchainos-skills/releases/download/v<version>/checksums.txt" -o /tmp/onchainos-checksums.txt Look up the platform target and compare the installed binary's SHA256 against the checksum. On mismatch, reinstall (step 2) and re-verify. If still mismatched, stop and warn.
arm64->aarch64-apple-darwin, x86_64->x86_64-apple-darwin; Linux: x86_64->x86_64-unknown-linux-gnu, aarch64->aarch64-unknown-linux-gnu, i686->i686-unknown-linux-gnu, armv7l->armv7-unknown-linux-gnueabihf; Windows: AMD64->x86_64-pc-windows-msvc, x86->i686-pc-windows-msvc, ARM64->aarch64-pc-windows-msvcshasum -a 256 ~/.local/bin/onchainos; Windows: (Get-FileHash "$env:USERPROFILE\.local\bin\onchainos.exe" -Algorithm SHA256).Hash.ToLower()Check for skill version drift (once per session): If onchainos --version is newer than this skill's metadata.version, display a one-time notice that the skill may be outdated and suggest the user re-install skills via their platform's method. Do not block.
Do NOT auto-reinstall on command failures. Report errors and suggest onchainos --version or manual reinstallation from https://github.com/okx/onchainos-skills.
Rate limit errors. If a command hits rate limits, the shared API key may be throttled. Suggest creating a personal key at the OKX Developer Portal. If the user creates a .env file, remind them to add .env to .gitignore.
okx-securityoption.payTo | --pay-to |
option.asset | --asset | token contract address |
option.maxTimeoutSeconds | --max-timeout-seconds | optional, default 300 |
| - |
Recipient address (from x402 payTo field) |
--asset | Yes | - | Token contract address (from x402 asset field) |
--from | No | selected account | Payer address; if omitted, uses the currently selected account |
--max-timeout-seconds | No | 300 | Authorization validity window in seconds |
authorization.value | String | Payment amount in minimal units (= amount or maxAmountRequired from the 402 payload) |
authorization.validAfter | String | Authorization valid-after timestamp (Unix seconds) |
authorization.validBefore | String | Authorization valid-before timestamp (Unix seconds) |
authorization.nonce | String | Random nonce (hex, 32 bytes), prevents replay attacks |
now + maxTimeoutSeconds (Unix seconds) |
nonce | Random 32 bytes (hex) |