
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
402-trinity-gaming
Advanced tools
Headless x402 payment backend for game storefronts. No UI, no overlay, no console output - a call in, an event out.
A payment backend for game storefronts that your players never see.
No UI. No overlay. No browser handoff. No console output. Your button, your art, your unlock animation — this handles the money and gets out of the way.
npm install 402-trinity-gaming
Your storefront UI ──▶ your backend ──▶ chain
(Unreal/Unity) (this package)
▲ │
└────── events ─────────┘
The player's client signs one authorization with their own key. Your server does everything
else. You never hold the player's key, and for direct purchases you hold no balance
either. (Tabs are the exception - see INTEGRATION.md.)
import { createStorefront } from '402-trinity-gaming/storefront';
const store = createStorefront({
payTo: '0xYourStudioWallet',
network: 'base',
facilitator: 'https://your-facilitator.example', // REQUIRED - no default
nonceStore, // REQUIRED - must survive restarts
catalog: {
vanguard_skin_01: '1500000', // atomic units: 1.50 USDC (6 decimals)
season_pass_04: '9990000', // 9.99
},
surcharge: { proceedsKey }, // the key for payTo
});
store.on('settled', e => grantItem(e.playerId, e.itemId));
store.on('declined', e => showRefusal(e.playerId, e.code));
Serve the quote, take the signature, redeem it:
// 1. the client asks what it must sign
const quote = store.quote('vanguard_skin_01');
// 2. the client signs it and posts back { authorization, signature }
const result = await store.purchase({
itemId: 'vanguard_skin_01',
playerId: 'player-8823',
playerAddress: '0xPlayerWallet',
authorization,
signature,
});
| event | when | what to do |
|---|---|---|
accepted | the request is well formed, the item is real, settlement is underway | grant optimistically if you want the item to appear instantly |
settled | the money has moved, with an on-chain transaction hash | grant, or reconcile an optimistic grant |
declined | it was refused | read code, not message |
Decline codes are unknown_item, already_used, rejected, settlement_failed and
malformed. Each carries retryable — true means the same authorization may be presented
again unchanged, false means mint a fresh one. Re-sending when retryable is false risks
paying twice.
Atomic units of the asset, as a decimal string. USDC has 6 decimals, so 1.50 is
'1500000'. A float cannot represent money exactly, and this value goes inside a signature.
This library never writes to stdout or stderr — that is enforced by its build, not by
convention. Diagnostics reach you through onDiagnostic, and the fee disclosure is exported
as NOTICE for you to place wherever disclosure belongs in your product.
Base mainnet + USDC. Other EVM chains work by passing customChains. Check any entry
against the deployed contract first: call DOMAIN_SEPARATOR() and confirm it matches what
this library computes. A wrong name or version produces a signature that looks valid and
the contract rejects.
This software signs payment authorizations. You are responsible for the funds in any wallet
you configure it with and for the limits you set. nonceStore must be durable — an in-memory
replay guard forgets every settled payment on restart, which means selling the same item twice
for free.
Business Source License 1.1. Source-available; converts to MIT on 2029-08-25. See LICENSE.
Network fee: 0.1% of merchant proceeds and 1 cent every 100 sales.
FAQs
Headless x402 payment backend for game storefronts. No UI, no overlay, no console output - a call in, an event out.
We found that 402-trinity-gaming demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.