POST /api/x402/verify validates a payment payload before you serve your resource. The withPayment() middleware calls this automatically.
What gets checked
Nonce replay protection
Every EIP-3009 authorization includes a uniquenonce. Conduit calls authorizationState(authorizer, nonce) on the Arc USDC contract before processing. If the nonce was already used, Conduit rejects the payment. Replay attacks are impossible.

