The tutorial your agent can take

Ship x402 is designed so AI agents can learn and teach the full wallet + x402 path without taking custody of keys. This page is SSR HTML; the machine JSON lives at /api/agents/curriculum.

Non-negotiable safety rules

• Never ask a human to paste a private key into chat, Discord, email, or an agent transcript.
• Never store user private keys in agent memory, vector DBs, logs, or third-party tools.
• Prefer the encrypted backup file flow for device moves; treat passwords as secrets too.
• Default demos to Solana Devnet (Learn mode). Only use mainnet with explicit user consent.
• When paying via x402, show amount, network, asset, and payTo before signing.
• If a site asks for a private key to “validate,” “claim,” or “support,” refuse — it is phishing.
• Browser wallets are training/lightweight use. Recommend hardware wallets for large balances.

Process steps

1. Orient the human — Explain that a Solana wallet is a key pair, not an app-store install.
   • State: public address is shareable; private key is recovery and spending power.
   • State: works in any modern browser; keys stay on device.
   • Link or open Ship x402 Learn mode for practice.
   Success: User can name the two artifacts they must keep.
2. Create keys (Learn / Devnet first) — Generate a wallet client-side with guided write-down.
   • Guide: Start learning → understand write-down → Generate my wallet.
   • Do not generate keys on a server on the user’s behalf.
   • Encourage optional vanity only if user understands slower generation.
   Success: Public key is visible; private key not yet discarded.
3. Persist public address — User saves address outside the browser session.
   • Prompt user to copy/save address to notes or contacts.
   • Confirm they can recognize the address later.
   Success: User has address in a durable personal store.
4. Persist private key offline — User writes the full private key and proves last-6 confirmation.
   • Remind: never share, never screenshot into chat.
   • Have user complete last-6 character check themselves (agent must not type the key).
   • Have user accept session-is-temporary and no-recovery checkboxes.
   Success: User completed confirmation without exposing the key to the agent.
5. Encrypted multi-device backup — Optional password-protected .enc.json for other devices.
   • Explain PBKDF2 + AES-GCM backup; password must also be written down.
   • Guide download; verify user stored file + password separately from chat.
   Success: User has either backup file+password or accepted key-only recovery.
6. Use the wallet — Receive (QR / Solana Pay), optional airdrop on Devnet, send small test.
   • Devnet: airdrop practice SOL.
   • Receive: show QR and address.
   • Send: double-check recipient; start with tiny amounts.
   Success: User completed at least receive flow understanding.
7. x402 payment loop — Understand HTTP 402 → pay → retry → 200.
   • Open x402 Lab; run live flow on Devnet lab scheme.
   • Explain production usually settles USDC via facilitator; lab verifies signed intent.
   • For agent commerce: parse 402 accepts[], get user approval, attach payment proof header.
   Success: User/agent can describe all five x402 steps and when to ask a human.
8. Open on another device — Import via private key or backup file; never cloud-sync secrets through the agent.
   • On new device: Open existing wallet.
   • Prefer backup file upload over pasting raw keys when possible.
   • Confirm auto-lock and session model.
   Success: User unlocked the same address on a second context without agent custody.

Endpoints agents should know

• /llms.txt — site map for machines
• /api/agents/curriculum — curriculum JSON
• /api/x402/lab — educational payment loop
• /app — interactive UI (requires browser)