CreditRail

x402's deferred scheme defines how AI agents can pay later. CreditRail defines who is allowed to — a credit layer priced by collateral and history.

Comment

Inspiration

We started by looking at what agentic payments still can't do. x402 makes it trivial for an AI agent to pay for an API call over HTTP, and Cloudflare's proposed deferred extension lets those payments batch instead of settling one by one. That solves the mechanics of paying later.

But reading the specification closely, we noticed it says nothing about creditworthiness. Nothing defines who qualifies to defer, how much exposure is acceptable, or what happens when an agent doesn't pay. This is deliberate — x402 requires no account and no personal data from the payer, which is exactly why it works permissionlessly. It also means the protocol structurally cannot answer the credit question itself.

Then we tried to break our own idea. If an agent defaults, it abandons its wallet and creates a new one. We spent a long time trying to design detection mechanisms around this before accepting the real conclusion: unsecured credit under full pseudonymity is not a cryptography problem; it's an identity problem. DeFi lending is uniformly over-collateralised for exactly this reason, and the few under-collateralised protocols all anchor borrowers to real-world legal entities.

That reframing became the product. Instead of pretending to solve pseudonymous unsecured credit, we made the constraint explicit: the leverage you can obtain equals the identity cost you're willing to bear.

What it does

CreditRail is a credit judgment layer that sits between AI agents and merchants on x402. When an agent requests a paid resource, the gateway checks its credit state and either requires prepayment or accepts a signed commitment to pay later. Approved agents sign an EIP-712 commitment, receive the resource immediately with zero on-chain writes, and many obligations settle together in a single transaction at the end of the cycle.

Creditworthiness is computed deterministically from historical state rather than accumulated per event, so the same inputs always produce the same score and every snapshot stores its inputs for independent verification:

score = 10
      + 40 × min(1, log10(1 + settled_credit) / 3)   // repaid deferred volume
      + 25 × min(1, active_days / 90)                // account age
      + 15 × min(1, collateral / 100)                // skin in the game
      + 10 × on_time_ratio
      − 40 × default_count 
      − 5 × late_count

Only repaid deferred obligations count toward settled_credit. Prepayment proves an agent has funds; it does not prove they repay.

The product is split into two tracks:

Track A — pseudonymous. Collateral ratios of 1.0–1.5 give a coverage ratio of collateral_ratio ≥ 1 at every tier, with a utilisation alert at 90% so operators can top up or settle before the limit binds. Merchants carry no unsecured exposure, which makes Sybil attacks and bust-out fraud structurally unprofitable without any behavioural detection.

Track B — identity-anchored. Agents binding to a KYC exchange account, a verified business entity, or a non-transferable attestation can exceed 1× leverage, with residual risk covered by identity cost, legal recourse, and risk-based pricing.

Merchants are the paying customer, not agents. Pricing follows the BNPL model — a merchant discount rate scaled to loss-given-default, from 0.5% on fully-collateralised Track A up to 3.5% on Track B.

How we built it

We work in x402's deferred extension rather than forking the protocol, so merchants only swap a middleware and existing x402 clients need no changes.

Contracts. CreditVault in Solidity 0.8.20 on Base Sepolia, using OpenZeppelin's ReentrancyGuard, AccessControl, EIP712 and SafeERC20. It handles collateral staking and withdrawal, batch settlement, and default liquidation.

Off-chain obligations, on-chain verification. Our first architecture wrote every obligation on-chain at request time. We caught that this made the gas argument false — twenty deferred calls became twenty-one transactions, worse than prepaying. Obligations now live in Postgres during the cycle and the contract verifies every EIP-712 signature itself at settlement, so N obligations settle in exactly one transaction and the gateway cannot fabricate debt. Nonces and resource-hash binding prevent replay across both repeated and higher-priced endpoints.

Backend. Fastify gateway intercepting 402 responses, a rule-based credit engine, and Postgres with Prisma. Scoring is a pure function over agent state, which makes it trivially unit-testable. We validated it against a full lifecycle walkthrough from Day 0 to Day 90.

Frontend. React, TypeScript, Tailwind and Recharts. The credit detail view decomposes a score into its five contributing terms, because an auditable model should be legible, not just deterministic.

Challenges we ran into

The attack we couldn't detect our way out of. Building credit with honest repayment, drawing the full limit and disappearing is the hardest failure mode in any credit system. We initially wrote an economic argument showing attack cost exceeded attack revenue, then realised the argument was wrong: we had counted the attacker's spending as a cost, but that spending buys equivalent services. It isn't a loss. Worse, the most dangerous attacker is a genuine customer who was going to use those APIs anyway, whose marginal cost of building credit is zero and whose behaviour is indistinguishable from a legitimate user until the moment they leave. We eventually stopped trying to detect it and made it structurally unprofitable instead. In Track A, coverage is provably at or above 100%, so defaulting yields negative marginal return. No detection required.

Every mechanism we added created a new hole. Unlimited token approval quietly turned a non-custodial design into a custodial one. A scoring rule that rewarded on-time payment by transaction count let an attacker reach the top tier on eight trivial payments. Counting prepayments toward tier progression meant an agent could climb the entire ladder without ever demonstrating that it repays. Each of these looked reasonable in isolation and broke under adversarial reading.

Getting the economics to close. Our first pricing model charged a flat 0.1% settlement fee. Working out the break-even default rate gave 0.12%, far below what any unsecured credit product sustains. Credit cards run 2–3% charge-offs with KYC, courts, and credit bureaus behind them. We rebuilt pricing around loss-given-default per track.

Accomplishments that we're proud of

A safety property we can prove rather than assert. Coverage equals collateral ratio divided by the utilisation cap, and every Track A tier satisfies the inequality. It fits on one slide and doesn't rely on any assumption about attacker behaviour.

Turning a limitation into the thesis. Recognising that pseudonymous unsecured credit is unsolvable could have killed the project. Instead, it produced the framing we now lead with: leverage equals identity cost. It's a more honest claim than most credit products in this space make, and it's the reason the two-track structure exists at all.

Refusing to overclaim. We corrected our own materials to state that deferred is a Cloudflare-proposed extension rather than the core x402 specification, and that Cloudflare has already shipped implementations of it. Our contribution is the credit layer, not the mechanism.

What we learned

Credit systems don't work by preventing default. They work by pricing it. Every hour we spent designing detection would have been better spent on the collateral structure, because a structural guarantee doesn't depend on being right about attacker behaviour.

Reading a protocol specification for what it deliberately leaves out turned out to be more productive than reading it for what it does. x402's absence of identity isn't an oversight. It's the design decision that makes the protocol permissionless, and it's precisely why a separate credit layer has to exist.

The economics of an attack are marginal, not gross. Sunk spending that purchased real value is not a cost, and getting this wrong made our security argument collapse the first time someone did the arithmetic properly.

Also, a scoring model that recomputes from state rather than accumulating events is far easier to test, audit, explain, and being able to decompose a score into its terms on screen turns out to be worth more in a conversation than any amount of writing about auditability.

What's next for CreditRail

Immediate. Complete the working prototype end to end and verify batch settlement on Base Sepolia, so the gas claim can be checked on a block explorer rather than taken on faith. Replace the scripted agent with a real LLM agent making treasury decisions — choosing between cash and credit, and whether to settle early to preserve limit headroom.

Track B. Bind credit profiles to KYC exchange accounts. Exchanges have already solved custody, identity, liquidation, and licensing at scale. A read-only API credential or an exchange-issued attestation is enough to lift an agent above 1× leverage without CreditRail ever handling personal data.

Portability. The harder open problem is that identities cannot be correlated across custodians, so a shared blacklist isn't achievable today. Hashed commitments from a shared KYC provider, or zero-knowledge proof of uniqueness, are the directions we want to explore — because an agent shouldn't lose its credit history for changing where it holds funds.

Built With

Share this project:

Updates