Errors

PayKit::new returns Result<PayKit, PayKitError>, so a bad configuration fails at startup rather than at request time. Per-request payment failures are turned into the 402 response by the gate — your handler only runs once a payment verifies.

PayKitError

The error carries which protocol handler rejected the config:

let pay = match PayKit::new(config) {
    Ok(pay) => pay,
    Err(PayKitError::Mpp(msg)) => panic!("MPP config rejected: {msg}"),
    Err(PayKitError::X402(msg)) => panic!("x402 config rejected: {msg}"),
};

Boot-time safety rails

PayKit::new validates the config up front:

• A challenge_binding_secret shorter than 32 bytes (or empty) is rejected — generate one with openssl rand -base64 32. When it is None, the MPP layer reads MPP_SECRET_KEY.
• An unknown network slug is rejected; the canonical slugs are mainnet, devnet, and localnet.