update seller and buyer guide

Author: AyushBherwani1998

smart-accounts-kit/guides/x402/buyer/advanced-permissions.md

@@ -52,7 +52,7 @@ const sessionAccount = privateKeyToAccount('0x...')
 
 ### 3. Get payment requirements
 
-Call the protected API route once without a payment header.
+Call the protected API route once without the `PAYMENT-SIGNATURE` header.
 
 The server returns `402` with the payment terms (`PAYMENT-REQUIRED`) in the response, which you use
 to build the payment payload.
@@ -222,7 +222,7 @@ For ERC-7710 (Smart Contract Delegation), x402 requires the payload fields `dele
 `permissionContext`, and `delegator`. The facilitator uses `permissionContext` to simulate
 during verification and then settle the payment.
 
-Encode the full x402 payment payload as base64, then send it in the `payment-signature` header.
+Encode the full x402 payment payload as base64, then send it in the `PAYMENT-SIGNATURE` header.
 
 <Tabs>
 <TabItem value="example.ts">
@@ -267,13 +267,13 @@ export type PaymentPayload = {
 
 ### 7. Make the paid request
 
-Send the base64-encoded x402 payment payload in the `payment-signature` header.
+Send the base64-encoded x402 payment payload in the `PAYMENT-SIGNATURE` header.
 If verification succeeds, the server returns the protected data.
 
 ```ts
 const apiResponse = await fetch('https://api.example.com/paid-endpoint', {
   headers: {
-    'payment-signature': encodedPayment,
+    'PAYMENT-SIGNATURE': encodedPayment,
   },
 })
 

smart-accounts-kit/guides/x402/buyer/delegations.md

@@ -69,7 +69,7 @@ export const buyerAccount = privateKeyToAccount('0x<BUYER_PRIVATE_KEY>')
 
 ### 2. Get payment requirements
 
-Call the protected API route once without a payment header.
+Call the protected API route once without the `PAYMENT-SIGNATURE` header.
 
 The server returns `402` with the payment terms (`PAYMENT-REQUIRED`) in the response, which you use
 to build the payment payload.
@@ -194,7 +194,7 @@ For ERC-7710 (Smart Contract Delegation), x402 requires the payload fields `dele
 The facilitator uses `permissionContext` to simulate during verification and then settle the payment.
 
 Use `encodeDelegations` to encode the delegation chain.
-Then base64 encode the full x402 payment payload before sending it in the `payment-signature` header.
+Then base64 encode the full x402 payment payload before sending it in the `PAYMENT-SIGNATURE` header.
 
 <Tabs>
 <TabItem value="example.ts">
@@ -238,13 +238,13 @@ export type PaymentPayload = {
 
 ### 5. Make the paid request
 
-Send the encoded x402 payment payload in the `payment-signature` header.
+Send the encoded x402 payment payload in the `PAYMENT-SIGNATURE` header.
 If verification succeeds, the server returns the protected data.
 
 ```ts
 const apiResponse = await fetch('https://api.example.com/paid-endpoint', {
   headers: {
-    'payment-signature': encodedPayment,
+    'PAYMENT-SIGNATURE': encodedPayment,
   },
 })
 

smart-accounts-kit/guides/x402/buyer/recurring-payments.md

@@ -100,7 +100,7 @@ const grantedPermissions = await walletClient.requestExecutionPermissions([
 
 ### 4. Get payment requirements
 
-Call the x402-protected endpoint without a payment header to request payment terms
+Call the x402-protected endpoint without the `PAYMENT-SIGNATURE` header to request payment terms
 after your agent has been granted permission.
 
 The server returns `402` with the payment terms (`PAYMENT-REQUIRED`) in the response, which agent can use to
@@ -225,7 +225,7 @@ For ERC-7710 (Smart Contract Delegation), x402 requires the payload fields `dele
 `permissionContext`, and `delegator`. The facilitator uses `permissionContext` to simulate
 during verification and then settle the payment.
 
-Encode the full x402 payment payload as base64, then send it in the `payment-signature` header.
+Encode the full x402 payment payload as base64, then send it in the `PAYMENT-SIGNATURE` header.
 
 ```ts
 import { PaymentPayload } from './types'
@@ -247,12 +247,12 @@ const encodedPayment = Buffer.from(JSON.stringify(paymentPayload)).toString('bas
 
 ### 7. Make the paid request
 
-Send the base64-encoded x402 payment payload in the `payment-signature` header.
+Send the base64-encoded x402 payment payload in the `PAYMENT-SIGNATURE` header.
 
 ```ts
 const apiResponse = await fetch('https://api.example.com/paid-endpoint', {
   headers: {
-    'payment-signature': encodedPayment,
+    'PAYMENT-SIGNATURE': encodedPayment,
   },
 })
 

smart-accounts-kit/guides/x402/seller.md

@@ -61,9 +61,9 @@ header, verifies it through the facilitator, and settles it before the protected
 It also fetches the current facilitator signer address and includes it in
 `PaymentRequirements.extra.facilitators`.
 
-When the header is missing, the middleware encodes the payment requirements in a `PAYMENT-REQUIRED`
+When the `PAYMENT-SIGNATURE` header is missing, the middleware encodes the payment requirements in a `PAYMENT-REQUIRED`
 response header and returns `402 Payment Required` with a JSON body that tells the buyer how to pay.
-When the header is malformed, the middleware returns `400 Bad Request`.
+When the `PAYMENT-SIGNATURE` header is malformed, the middleware returns `400 Bad Request`.
 
 The middleware builds payment requirements that follow the [x402 payment requirements schema](https://docs.x402.org/core-concepts/http-402#payment-headers-in-v2).
 Set `scheme` to `exact` and `assetTransferMethod` to `erc7710` so the facilitator routes the
@@ -91,7 +91,7 @@ request and returns it in the `PAYMENT-REQUIRED` response header when payment is
 </TabItem>
 <TabItem value = "PaymentPayload">
 
-Decoded delegation payload the buyer sends in the `payment-signature` request header. The
+Decoded delegation payload the buyer sends in the `PAYMENT-SIGNATURE` request header. The
 middleware forwards this object to the facilitator's `/verify` and `/settle` endpoints.
 
 | Name                        | Description                                                                                                                                            |
@@ -139,8 +139,7 @@ export function createPaymentMiddleware(options: PaymentMiddlewareOptions) {
       },
     }
 
-    const paymentHeader =
-      (req.headers['payment-signature'] as string) || (req.headers['x-payment-signature'] as string)
+    const paymentHeader = req.get('PAYMENT-SIGNATURE')
 
     if (!paymentHeader) {
       const paymentRequired = {
@@ -150,6 +149,7 @@ export function createPaymentMiddleware(options: PaymentMiddlewareOptions) {
         mimeType: options.mimeType || 'application/json',
       }
       const encoded = Buffer.from(JSON.stringify(paymentRequired)).toString('base64')
+      res.setHeader('Access-Control-Expose-Headers', 'PAYMENT-REQUIRED, PAYMENT-RESPONSE')
       res.setHeader('PAYMENT-REQUIRED', encoded)
       res.status(402).json({ error: 'Payment Required', paymentRequired })
       return
@@ -388,6 +388,7 @@ the buyer can correlate the result with the original request.
 +      payer: verifyResult.payer,
 +    }
 +    const encodedResponse = Buffer.from(JSON.stringify(paymentResponse)).toString('base64')
++    res.setHeader('Access-Control-Expose-Headers', 'PAYMENT-REQUIRED, PAYMENT-RESPONSE')
 +    res.setHeader('PAYMENT-RESPONSE', encodedResponse)
 // add-end