Mostly, but not strictly. In a minimal x402 gate, the replay ledger is the one piece of application-side state you cannot skip. It is the record that stops a single payment authorization or proof from buying more than one response. Production flows usually add two more kinds of state: settlement tracking and idempotency for side-effecting resources. A database may hold all three, but they answer different questions. Exactly where the boundary falls depends on the payment scheme and on whether you fulfill before or after settlement.
Why “the only stateful part” needs a qualifier
The x402 V2 specification splits payment handling into two facilitator-style operations with different state semantics:
As an Amazon Associate I earn from qualifying purchases.
/verifyis read-only. It validates payment state and must not commit payment state or write onchain state./settledurably commits payment state. Settlement may consume a challenge or mark a transaction as used, and in some flows it can be called more than once.
So the mutable record that matters most does not live in verification. It appears at the moment something is consumed or settled. Your gate’s ledger is how your own system learns that this has happened, or claims the right to make it happen. Beyond that, a resource that does something irreversible, such as sending an email, running a paid job or minting an item, needs its own record of what it already did. That is a separate responsibility from payment-use tracking.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow the flow creates the need for a ledger
The x402 Foundation describes the typical sequence this way:
#1 Best Overall
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of cards, no known remote hacks.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- The client requests a resource.
- The server answers
402 Payment Requiredwith payment requirements. - The client retries with a signed payment payload.
- The resource server or a facilitator verifies the payload.
- If valid, the server fulfills the request, and payment is settled before the final response.
Schemes vary. The foundation lists exact amount, usage up to a maximum, and batch settlement as examples.
The V2 specification sets one ordering invariant: at least one verify or settle check must run before the resource executes. It does not fix when settlement happens. Some designs settle after fulfillment and others settle first.
The race
Suppose settlement follows fulfillment. Two server instances receive the same still-valid authorization and each runs a read-only verification. Both pass, because neither has consumed anything yet. Unless the scheme’s network primitive rejects the second use, or a shared atomic claim does, both instances may deliver the resource. The ledger exists to close that window.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Solana’s official facilitator guidance for Solana deployments says to persist consumed payment identifiers and transaction signatures in a shared, durable store, and to make verification and consumption atomic across instances. That is implementation guidance for Solana, not a rule applied identically to every scheme and network.
What the ledger has to record
No single key or retention period is correct for every scheme. The exact-scheme rules instead require each method to specify its replay primitive, its validity window and its duplicate-submission behavior. For proofs the client submits, the exact scheme calls for:
- Request binding, so a proof is tied to the request it paid for.
- An atomic single-use claim, so two concurrent submissions cannot both succeed.
- A canonical consumption key built from the network plus a canonical payment identifier, so different encodings of the same payment collide.
- Retention for as long as the proof remains presentable. Once the proof can no longer be accepted, the entry can expire.
Binding also changes how much deduplication you need. A proof bound to a particular payee or request limits where it can be reused. An unbound proof may require deduplication across every facilitator that serves the same payee.
Rank #3
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
Payment replay is not the same as double delivery
Some networks make nonce consumption authoritative, so a second onchain use of the same authorization fails. The exact-scheme document points out that this stops a double spend but not necessarily double delivery. If the same successful submission result is returned to several callers, each of them could receive the resource though only one payment landed. In that case the document requires atomic settlement deduplication across processes until the payment can no longer land. Network-level protection and an application ledger therefore address different failures.
The other state you may need
Settlement state
Because /settle can be called more than once in some flows, and may happen after fulfillment, you may need to know whether settlement was attempted, succeeded or failed for a given payment. That record is not the same as “this proof was claimed.” A claim can exist while settlement is still pending or has failed, and your recovery logic needs to tell those cases apart.
Resource-operation idempotency
Solana’s guide recommends an idempotency key for side-effecting resource operations, and returning the original result when a legitimate retry arrives. A client may retry after a timeout without intending to pay twice, and the idempotency record lets you answer without redoing the work. It protects fulfillment behavior. It does not replace payment-level replay protection, and replay protection does not give you idempotent side effects.
Rank #4
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Comparing implementations
These axes follow from the protocol’s flow and the exact-scheme rules. Use them to see where your own gate’s state boundary sits.
| Axis | Question to answer | Effect on state |
|---|---|---|
| Replay primitive | Does the network or scheme reject reuse, or only your application? | Network enforcement reduces double-spend risk but not necessarily double delivery. |
| Request binding | Is the proof tied to one request or payee? | Unbound proofs may need deduplication across all facilitators for the payee. |
| Validity window and retention | How long can the proof still be presented? | Sets how long a ledger entry must be kept. |
| Duplicate-submission semantics | What happens on a second submission of the same proof? | Determines whether you return an error, the prior result or a no-op. |
| Atomicity | Does the claim cover every process that can accept the proof? | Requires a shared store with an atomic claim, not per-instance memory. |
| Fulfill-then-settle or settle-then-fulfill | When is the payment actually consumed? | Fulfill-first widens the race window and raises the need for recovery state. |
Practical design rules
- Do not keep the ledger in process memory. Any instance that can accept the same authorization must see the same claim, atomically.
- Make “check and consume” a single atomic operation, such as an insert that fails on a duplicate key. Do not read the ledger and write it in two steps.
- Build the key from the network and a canonical payment identifier as your scheme defines it. Do not assume one nonce format across schemes.
- Keep entries for as long as the proof could still be presented, then expire them.
- Store payment-use, settlement and operation-idempotency records as distinct fields or tables, even if they share a database.
- Treat the facilitator as a role, not a required third party. Managed, separately self-hosted or in-process facilitation are all valid, but whichever you choose, the atomic claim has to cover every place that can accept the proof.
Version and scope limits
The semantics above are those of the V2 core specification, which separates shared data types, scheme- and network-dependent payment logic, and transport representation. The V1 specification documents EIP-3009 nonce, time-window and signature protections. These are examples tied to a version and a scheme, not proof that every x402 flow needs state in only one place. No published adoption figures, replay-rate statistics or performance benchmarks are cited here, because none were found in the specification and implementation-guidance pages this article draws on.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe Bottom Line
Treat the replay ledger as the minimum application-side state, not the whole of it. A narrow flow can run on that alone. Once settlement can lag fulfillment or the resource has side effects, add settlement tracking and idempotency records next to it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
