Server access check

Keep a tenant API key with the paywall or admin role on your server. Checkout tokens and buyer receipt cookies cannot call this endpoint. Authenticate the buyer wallet in your own product before checking it.

Check a wallet and plan

bash

POST /v1/integration/tenants/{tenant}/access/check
X-API-Key: $PAYWALL_API_KEY
Content-Type: application/json

{
  "wallet": "0x1111111111111111111111111111111111111111",
  "plan_id": "pro_30"
}

Decision

json

{
  "allowed": true,
  "plan_id": "pro_30",
  "reason": "ok",
  "expires_at": "2026-11-15T12:00:00Z",
  "status": "active"
}

Info

HTTP 200 contains an allow or deny decision. Read the allowed field; do not treat a successful HTTP request as permission. Checks for a specific plan use current database state. Return protected content only for allowed: true. Deny access when the API is unavailable.

No policy creation endpoint is required. The standalone example in examples/paid-content demonstrates a five-minute single-use wallet challenge, a separate HttpOnly 24-hour session and a fresh access check for every material read. A receipt session does not sign the buyer into your product.