Permit2 Signing

Copy page

B402 supports permit2-exact and permit2-upto through Uniswap Permit2 witness transfers. This page describes the values that must be consistent across the merchant's HTTP 402 response, the buyer's EIP-712 signature, and the B402 Verify/Settle request.

Address Roles

Value	Role	Source
Canonical Permit2 contract	ERC-20 allowance target and EIP-712 verifying contract	0x000000000022D473030F116dDEE9F6B43aC78BA3
extra.spenderAddress	B402 proxy authorized to execute the Permit2 witness transfer	/supported
extra.signerAddress	Facilitator EOA that submits settlement and pays gas	/supported
paymentRequirements.payTo	Merchant receiving address	Merchant server
permit2Authorization.from	Buyer/payer address and EIP-712 signer	Buyer wallet

Shared Authorization Fields

paymentPayload.payload.permit2Authorization contains:

Field	Meaning
permitted.token	ERC-20 asset; must equal paymentRequirements.asset
permitted.amount	Exact amount or maximum authorized amount, in atomic units
from	Token owner and signature author
spender	extra.spenderAddress returned by /supported
nonce	Unused Permit2 nonce, encoded as a decimal string
deadline	Unix timestamp after which Permit2 rejects the authorization
witness.to	Merchant address; must equal paymentRequirements.payTo
witness.validAfter	Earliest Unix timestamp at which settlement is allowed
signature	65-byte EIP-712 signature as 0x-prefixed hex

The HTTP 402 paymentRequirements.extra object and paymentPayload.accepted.extra must retain name, version, assetTransferMethod, signerAddress, and spenderAddress exactly as returned by /supported.

permit2-exact

Use scheme: "exact" and assetTransferMethod: "permit2-exact".

• permitted.amount equals paymentRequirements.amount.
• settleAmount is omitted.
• The witness is Witness(address to,uint256 validAfter).
• witness.facilitator is omitted.

The buyer signs a Permit2 witness-transfer typed message bound to the B402 exact proxy and merchant recipient. B402 transfers exactly the authorized amount.

permit2-upto

Use scheme: "upto" and assetTransferMethod: "permit2-upto".

• permitted.amount equals the maximum paymentRequirements.amount.
• The merchant supplies settleAmount when calling Settle.
• settleAmount must be positive and no greater than permitted.amount.
• The witness is Witness(address to,address facilitator,uint256 validAfter).
• witness.facilitator equals extra.signerAddress.

Binding the facilitator address prevents another caller from executing the up-to authorization. The buyer signs the upper limit once; the merchant determines the final amount at settlement time.

Example Payload Fragment

Code
{
  "signature": "0x...",
  "permit2Authorization": {
    "permitted": {
      "token": "0x1111111111111111111111111111111111111111",
      "amount": "1000000"
    },
    "from": "0x2222222222222222222222222222222222222222",
    "spender": "0x3333333333333333333333333333333333333333",
    "nonce": "123456789",
    "deadline": "1780000000",
    "witness": {
      "to": "0x4444444444444444444444444444444444444444",
      "facilitator": "0x5555555555555555555555555555555555555555",
      "validAfter": "0"
    }
  }
}

The facilitator field above is present only for permit2-upto.

Validation Checklist

Before calling Verify, ensure:

1. The chain ID in the EIP-712 domain matches paymentRequirements.network.
2. The EIP-712 verifying contract is the canonical Permit2 contract.
3. spender, witness.to, asset, amount, and method match the server-held requirement.
4. The nonce is unused and both deadline and validAfter are valid.
5. The payer has enough token balance and Permit2 allowance.
6. For permit2-upto, witness.facilitator and settleAmount follow the rules above.

Never accept typed-data fields supplied only by the buyer without comparing them to the merchant's server-side payment requirement.