Nava Gateway developer overview

The preview places a Nava Guardian policy verdict between normal x402 verification and merchant settlement for EIP-3009 USDC on Base or Base Sepolia. The facilitator submits the transfer and sponsors its ETH gas only after the payment has passed the applicable gates.

Integrate the Nava Gateway Developer Preview into this x402 project. Inspect the current verifier and settlement flow first, then ask whether I am protecting a resource server with the Nava facilitator or wrapping an existing facilitator. Preserve the existing x402 verification and do not alter signed payment fields. Require a terminal approving Guardian verdict before settlement, but keep settlement outside verifyPayment and withGuardian. Leave allowPromptOverride unset or false so the Guardian description is derived from the signed payment action, never an unsigned payer override. Keep payment payloads, payer credentials, and Guardian credentials out of URLs, logs, errors, analytics, and stored transcripts. Treat rejection, pending, timeout, a missing or malformed verdict, and service failure as blocked. Add tests for the approved path and every fail-closed path, run the repository checks, and report changed files, checks run, preview limitations, and manual setup.

Choose a path

Shared primitive

Both integration paths use verifyPayment({ paymentPayload, paymentRequirements }, config). It maps signed authorization fields into a preview PaymentAction, submits that action to Guardian, polls within a bounded attempt count, and returns a normalized GuardianResult. It does not settle a payment.

Use the verdict's outcome as the policy decision. Do not create a local allowlist of reasonCode values; surface unknown codes and the accompanying human reason so newer Guardian responses remain diagnosable.

Security-first checklist

• Treat the payer-scoped Guardian key as a bearer secret.
• Keep it out of URLs, logs, errors, analytics, and stored payment transcripts.
• Use the verdict's outcome, not a local reasonCode allowlist, as the policy decision.
• Read the payment lifecycle and security and limitations before experimenting.