← back
Policy
Plain language. No legal theater.
What xapi is
xapi is an x402 payment proxy. We hold USDC in custodial wallets on your behalf and use it to pay x402-enabled APIs when you ask us to. We are not a bank, exchange, or financial institution.
Your wallet balance
Fund only what you need. We strongly advise keeping your xapi wallet lightly funded — enough for your near-term API usage, not a savings account.
- Your custodial wallet is encrypted at rest
- We do not have access to spend your balance without your API key authorizing a request
- You can request a refund at any time via your verified email
- Refunds go back to the address(es) that funded the wallet — we cannot send to arbitrary addresses
No guarantees. This is early-stage infrastructure. Systems can fail, bugs can happen, blockchain transactions are irreversible. In a catastrophic failure, your wallet keys may or may not survive depending on the circumstances. We are not responsible for loss of funds in these cases. We will do our best to prevent bad things from happening — and to fix them if they do. Fund only what you can afford to have stuck or lost in the event of a system issue.
Fees
- 1% deposit fee — taken on every deposit to your wallet. Non-refundable.
- No transaction fees — you pay the upstream x402 price, nothing extra from us.
- No refund fee — user-requested refunds are free (minus the deposit fee already taken).
- Abandonment processing fee — $0.50 if we sweep an inactive wallet (~2 years no activity).
- Gas fees — currently covered by the facilitator (Coinbase on production). If facilitator fee structure changes, your effective refund amount may be slightly reduced. We'll update this page if that happens.
Refunds
- You must verify your email to request a refund
- Unverified wallets cannot recover keys or request refunds — verify your email
- Refunds are queued and processed asynchronously
- USDC is returned to the original funding source address(es), pro-rata
- We cannot refund to a different address than the one that funded the wallet
- Deposit fees are non-refundable in all cases
Abandonment
If your wallet has no API activity for approximately 2 years, we consider it abandoned.
- Verified wallets: we will attempt to contact you before sweeping
- Unverified wallets: balance is swept with no notification (we have no way to reach you)
- Swept funds are returned to funding source addresses minus a $0.50 processing fee
- Wallets are never deleted — you can re-fund and reactivate at any time
x402 payments
- x402 payments are irreversible on-chain transactions
- We sign payments only when you send
X-Pay: true with a valid X-Pay-Max consent amount
- We will never pay more than your
X-Pay-Max for a single request
- We are not responsible for the quality, availability, or behavior of upstream x402 APIs
- We pin the upstream payTo address per domain — if it changes unexpectedly, we block the payment and alert you
Data
- We store: your email (if verified), wallet address, encrypted private key, transaction history, API key metadata
- We do not sell or share your data
- Transaction history is visible to you via the API
- On-chain transactions are public by nature of blockchain
Security
We take reasonable measures to protect your wallet and data. Wallet keys are encrypted at rest and decrypted only during payment signing. However, no system is perfectly secure. See the "fund lightly" advice above.
Testnet
We strongly recommend testing your integration on testnet before using production. Testnet uses Base Sepolia with free testnet USDC — no real value at risk.
Testnet note: Some features (like refund processing) require testnet ETH for gas. The facilitator wallet can run dry.
If you'd like to help keep the testnet running, you can send Base Sepolia ETH to:
0xBfD392F7b27c628B4F5040CCb12EaD6f57b00cA7
This is testnet only — no real value. Production uses Coinbase's facilitator which covers gas.
Base Sepolia faucets: Alchemy · QuickNode · Testnet USDC: Circle
Changes
We may update this policy. We won't sneak changes in — if something material changes, we'll note it here with a date.
Last updated: March 2026