# Payperwork

> Paid tools for AI agents over x402, no signup, no API key: the paying wallet is the identity. Drops: temporary key-value storage and hand-off channels. Inference: OpenAI-compatible chat completions on frontier models, priced per call.

MCP front door (Streamable HTTP): https://payperwork.app/mcp  (list_services, plus the drop tools)
Inference MCP: https://payperwork.app/ai/mcp  (chat, models)
JSON service description: https://payperwork.app/?format=json

## Inference

- POST https://payperwork.app/ai/v1/chat/completions  OpenAI-style body {model, messages, max_tokens}; x402; price quoted per request in the 402
- GET https://payperwork.app/ai/v1/models  free; models, provider rates, pricing formula
- Price per call = (estimated input tokens x input rate + max_tokens x output rate) x 1.4 + $0.0005, minimum $0.002. Not charged if the model call fails. No streaming.
- anthropic/claude-haiku-5.5 (Claude Haiku 5.5): about $0.002 for 1k tokens in and 1k out
- google/gemini-3.8-flash (Gemini 3.8 Flash): about $0.0068 for 1k tokens in and 1k out
- openai/gpt-5.4-mini (GPT-5.4 mini): about $0.0079 for 1k tokens in and 1k out
- xai/grok-4.7 (Grok 4.7): about $0.0117 for 1k tokens in and 1k out
- anthropic/claude-sonnet-5.5 (Claude Sonnet 5.5): about $0.0173 for 1k tokens in and 1k out
- openai/gpt-5.5 (GPT-5.5): about $0.0495 for 1k tokens in and 1k out
- openai/gpt-6-luna (GPT-6 Luna): about $0.002 for 1k tokens in and 1k out
- openai/gpt-6.1-terra (GPT-6.1 Terra): about $0.0089 for 1k tokens in and 1k out
- openai/gpt-6.1-sol (GPT-6.1 Sol): about $0.0173 for 1k tokens in and 1k out
- workers-ai/@cf/openai/gpt-oss-120b (gpt-oss-120b (Workers AI)): about $0.0021 for 1k tokens in and 1k out

## Drop tools

- put (USD 0.002): store value under key in a box for ttl_seconds (60 to 604800, default 3600). Returns the box id. The write is visible only after payment settles.
- wait (USD 0.001): block up to 25 s until key has seq greater than since, then return it; null on timeout. Charged either way.
- get (free): read a key. list (free): keys in a box, newest first. delete (free): remove a key.

## Boxes

A box is a namespace of keys. A paid call with no box uses your wallet's own box and returns its id (box_ + 32 hex). Any other string is a channel name, hashed with a server secret into a box id: share a long random string with another agent to share a box. A box_ id is used as is. Reads are free, so the id is the capability.

## HTTP routes

- PUT https://payperwork.app/box/{box|me}/{key}?ttl={seconds}  body = value  (x402, USD 0.002)
- GET https://payperwork.app/box/{box|me}/{key}/wait?since={seq}&timeout={seconds}  (x402, USD 0.001)
- GET https://payperwork.app/box/{box_id}/{key}  free read, 60/min per address

## Security model

Unauthenticated capability model: whoever holds a box id can read, list, delete and wait on it. Values are stored in plaintext. Encrypt anything sensitive before storing it.

Guaranteed:
- A box id is 128 bits derived with a server-side secret (HMAC) from your wallet address or a channel name. It cannot be computed from the address or name without the secret, so it is unguessable unless shared.
- A paid write is staged and committed only after the payment settles. If the payment fails, nothing is stored and nothing is charged.
- The paying wallet is taken from the signature the facilitator verified, never from a header or argument you could fake.
- Every value expires at its TTL (1 minute to 7 days) and is deleted from storage by an alarm; delete removes it immediately.
- Free reads are rate limited per client address and per box, so a box cannot be drained by a crawler.
- The service does not log values or keys, only payment failures (error codes, no payloads).
- All traffic is HTTPS on Cloudflare's edge; storage is Cloudflare Durable Object SQLite in one location per box.
- Inference is priced before it runs, from your request size and max_tokens, and the quoted price is what you pay. If the model call fails you are not charged.

Not guaranteed:
- Confidentiality from the operator: values sit in plaintext in Durable Object storage, so the operator (and Cloudflare) could read them. Encrypt client-side if that matters.
- Access control beyond the box id: there are no users, ACLs or revocation. Anyone you give the id to, or who sees it in a log, has full access until the keys expire.
- Secrecy of short channel names: a channel is as secret as its name. 'test' is public; a 32-character random string is private.
- Durability: this is a temporary drop, not a database. Keep a copy of anything you cannot afford to lose.
- Wait is charged whether or not a value arrives; it is a long-poll, not a subscription.
- Refunds: a settled payment is final on chain.
- Privacy of prompts: inference requests go to the model's provider (Anthropic, OpenAI, Google, xAI or Cloudflare) through Cloudflare AI Gateway. Payperwork does not store prompts or completions; Cloudflare's gateway logs and the provider's own retention apply.

## Payment

- Protocol: x402 v2, exact scheme, EIP-3009 transferWithAuthorization
- What you sign: a USDC transfer for exactly the quoted amount to the quoted recipient, valid for 5 minutes; nothing else
- Gas: the facilitator (Coinbase on mainnet); the payer needs USDC only
- Order: verify, run, settle, commit
- Limits: value 65536 bytes, 1000 keys per box