Skip to main content

​
Overview

The Laso Finance API uses the x402 protocol to gate endpoints behind crypto payments on Base or Solana (USDC). Agents and clients can programmatically order USA and international prepaid cards, gift cards, and send money to USD, EUR, or GBP debit cards. Sending money out to a bank account is a paywalled route like any other (GET /send-bank-payment), but the setup around it (opening the banking profile, registering who gets paid) is done through Firebase callables rather than paywalled routes, as is the managed agent wallet. See bank accounts and Beyond the x402 endpoints.

​
How x402 works

1

Call a paywalled endpoint

Make a request without a payment header. You’ll receive a 402 Payment Required response containing payment details (price, recipient address, network).
2

Construct a payment header

Use the details from the 402 response to create an x402 payment header with a Base or Solana USDC transaction.
3

Replay the request

Send the same request with the payment header attached. The server verifies the payment and processes your request.

​
Authentication

GET /auth is free: send a SIGN-IN-WITH-X header (a base64-encoded CAIP-122 signed message) to prove wallet ownership. The recommended way is wrapFetchWithSIWx from @x402/extensions/sign-in-with-x, which handles the full round-trip automatically. Paywalled endpoints (/get-card, /order-gift-card, /get-push-to-card, /order-intl-card, /send-payment) extract the payer’s wallet address from the x402 payment header and also return auth credentials in their responses. No separate API key is needed. The /auth and /get-card endpoints return auth credentials (id_token, refresh_token) that can be used as Bearer tokens for authenticated endpoints like /get-card-data. Always save these tokens so you can use the id_token for authenticated requests and the refresh_token to get a new token when it expires. When the id_token expires, use POST /auth with grant_type: "refresh_token" to get a new one (free).

​
Endpoints

​
Polling for card details (required)

IMPORTANT: /get-card does NOT return the card number, CVV, or expiry — it only returns a card_id with status: "pending". You MUST poll /get-card-data to retrieve the actual card details:
Poll every 2-3 seconds until status is "ready", then read card_details.

​
Beyond the x402 endpoints

Not everything an agent can do is a paywalled route. These are Firebase callables at https://us-central1-kyc-ts.cloudfunctions.net/<name>, authorized with the id_token from /auth, with arguments wrapped in a data object and replies in a result object.

​
Bank accounts

An agent can open real banking rails for its account and read back the resulting bank details. It drives every step except identity verification, which the account owner must complete in person. Paying someone is the one part that is a paywalled route rather than a callable: once a destination is registered, GET /send-bank-payment sends dollars to it and GET /bank-recipients lists what you can pay.

Bank accounts: give your agent real banking rails

Full walkthrough: the two account types, the application fields and their validation rules, and what the agent can and cannot do.

​
Managed agent wallet

Managed agent wallets

Custody model, paying third-party x402 services under a per-call cap and an expected asset, network, and recipient, and how refusals and failed settlements are reported.

​
Discovery

Agents can discover this API via:

​
Base URL