Stablecoin settlement in seconds
USDC and USDT on Celo both implement EIP-3009, so a payment is a signature rather than a transaction the payer has to broadcast. The server sponsors the gas; the caller only needs the stablecoin.
The exchange
Four steps, no accounts, no API keys.
Numbered by the status code each step actually produces — because this is a protocol exchange, not a feature list.
GET
Your client asks for something
An ordinary request to an ordinary URL. Nothing about the caller says "payment" yet — no key, no session, no prior relationship with the server.
402
The server names its price
The challenge carries the amount, the asset, the destination and the chain — and, if the endpoint requires it, a demand for proof of a verified human. Every term is on the wire before anything is signed.
SIG
Your wallet signs, locally
An EIP-3009 TransferWithAuthorization is signed by a key held in
your OS keychain. The key never leaves the machine and the server never sees
it — what crosses the wire authorises one amount, to one recipient, once.
200
The request is retried, and paid
The signature rides back on an X-PAYMENT header. The server
verifies it, settles on-chain, and answers the original request. Total added
latency: a few seconds.
What it does
A payment layer, and an identity layer, in one handshake.
Prove you're human, not who you are
A 402 challenge can demand a zero-knowledge attestation — over 18, not sanctioned — bound to the paying wallet. No documents are collected, no second signature is needed, and the server can re-verify the proof rather than trust it.
Your agent can pay for itself
An MCP server exposes payment as a tool, so an AI agent can call a paid endpoint
without a human in the loop. Nothing prompts per payment, so the guardrails are
the ones you set: pass maxAmount to abort before signing, and give
the agent its own wallet holding only what you would care to lose.
Buy things that aren't data
The same handshake buys a running machine: pay, and a real VM is provisioned with a lease that expires on its own. Payment for compute, priced per use, with no account anywhere.
Use cases
What this is actually for.
Paid APIs without onboarding
No signup, no dashboard, no key rotation. The first request is the whole relationship — which is the only model that works when the caller is software.
Machine-to-machine purchases
An agent that can hold a wallet can buy what it needs mid-task: a dataset, an inference call, a sandbox to run something in.
Gated endpoints without a KYC vendor
Age or sanctions checks arrive as a proof attached to the payment, so the endpoint learns whether a caller qualifies without ever holding their documents.
Metered compute
Sell a time-boxed VM the way you'd sell an API call. The lease is enforced by the cloud provider, so it ends whether or not anything else is still running.
Built on
Open protocols, all the way down.
Celo L2 · EVM
USDC EIP-3009
USDT EIP-3009
Self ZK identity
x402 open standard
Hackathon quickstart
Use buy without the repository.
With Node.js 20 or newer, the pinned npm package takes a clean machine from a new wallet to a paid VM on Celo mainnet. No clone, npm login, or global install is needed.
# 1 · create a dedicated wallet in your OS keychain$ npx --yes @celo/buy@0.4.1 setup --name hackathon ↳ fund the printed address with USDC or USDT on Celo mainnet ↳ the gateway sponsors gas, so the buyer does not need CELO ↳ only fund it with an amount you are comfortable spending
Public package, private source
@celo/buy@0.4.1 and its runtime packages are distributed through npm.
Participants can use the CLI and MCP server without access to the project repository.
Register the MCP server
npx --yes @celo/buy@0.4.1 mcp install --client all wires the server into Claude
Code and Codex. Six tools are registered by default; a seventh that moves money
directly stays opt-in behind an explicit budget or allowlist. Nothing runs
server-side — the wallet is read from your keychain over stdio.
Paid compute
Then buy a machine.
The public gateway sells one-hour, on-demand GCP VMs in us-west1.
Purchases of the e2-standard-* sizes require a Self proof for age
18+ and OFAC screening. The gateway verifies against the Self mainnet hub, so a
real passport is required — mock proofs are rejected.
# 2 · create a Self proof — required for the e2-standard sizes; buy.celo, age 18+, OFAC$ npx --yes @celo/buy@0.4.1 verify hosted --endpoint https://buy.celo-testnet.org/self/api/verify ↳ no cloudflared and nothing listening locally; the gateway hosts the receiver ↳ open the Self app with your real passport, then scan the QR # 3 · buy an e2-standard-2 VM; the 0.15 cap prevents a larger payment$ npx --yes @celo/buy@0.4.1 --verbose curl --max-amount 0.15 -X POST --data '{"script":"uname -a; nproc","machineType":"e2-standard-2"}' https://buy.celo-testnet.org/gcloud/vm 402 about 0.1340 USDC · celo · e2-standard-2 VM for 1 hour identity age 18+ · not sanctioned 200 { "transaction": "0x8238…", "instance": "", "poll": "https://buy.celo-testnet.org/gcloud/vm/823847337baade7f…" } # 4 · collect the output; this GET is free$ npx --yes @celo/buy@0.4.1 curl https://buy.celo-testnet.org/gcloud/vm/823847337baade7f… 200 { "scriptStatus": "done", "result": "Linux 6.1.0-51-cloud…" } ↳ if scriptStatus is absent, the VM is still booting; wait and poll again ↳ add --token USDT to pay in USDT instead of USDC
Self defaults are already set
verify hosted defaults to scope buy.celo, minimum age 18,
and OFAC screening. Re-run it when a stored proof expires. Cloudflared only
exposes the temporary HTTPS callback that Self needs; it does not hold your key.
Small, bounded VMs
Choose e2-micro (~0.0168), e2-small (~0.0335),
e2-medium (~0.0670), e2-standard-2 (~0.1340),
e2-standard-4 (~0.2680), or e2-standard-8 (~0.5361 USDC per hour).
Quotes are authoritative. The shared service allows up to 200 VMs, rejects
admission above $25/hour, uses on-demand instances only, and limits total
lease time to 24 hours.
Mainnet funds are real
Use a dedicated low-balance wallet and keep --max-amount close to the
quote. Payments are irreversible. Do not automatically retry
500 provision_failed or 500 settle_uncertain: settlement
may already have happened. A 4xx or 503 refusal occurs before settlement.
Scripts or SSH
/gcloud/vm accepts a startup script and returns its output through
the poll URL. /gcloud/ssh sells the same machine with an external IP
and your public key installed, priced identically. Instances run with internet
access and delete themselves when their lease ends.
Beta
buy is an early-stage hackathon service and has not had an external security review. It settles real USDC or USDT on Celo mainnet, so use a dedicated wallet and small balances. The temporary site is intentionally excluded from search indexing.