Sep 9, 2026 4 min read web

0x024 - x402 💸

x402 issue thumbnail

TL;DR (anyone needing to gatekeep content) - your server quotes a price in a header, gets paid in stablecoins.

What is it? 💡

HTTP 402 Payment Required has sat in the spec since January 1997, and the current standard still defines it as: "reserved for future use" - x402 leaves that alone and standardizes the headers around it instead.

A client sends a GET. The server answers 402 with a header naming the price, the wallet address to pay, and which chain and coin (in practice Base or Solana, nearly always USDC). The client signs an EIP-3009 payment authorization and re-sends the same GET with that signature attached. The server settles, usually via a facilitator, a service that verifies the signature and moves the money on-chain for you, then returns 200 and the data. Two round trips where the buyer never signs up.

$ curl -i "https://x402.ottoai.services/weather?location=London"
HTTP/2 402
payment-required: eyJ4NDAyVmVyc2lvbiI6MiwiZXJyb3IiOiJQYXltZW50...

# decodes to: $0.001 in USDC on Base, pay to 0x0E84...b808, 300s to complete

Q&A 💬

What stops the server (seller) from charging more? The amount and the recipient are inside the signed payload. Any change and the signature stops verifying.

What stops a replay? The nonce, which the smart contract marks spent on first use.

What does transferWithAuthorization actually do? A function on the token contract itself. It works out who signed from the signature, checks the expiry and the nonce, then moves the tokens. Whoever submits that call pays the gas, normally the facilitator.

Do I need a facilitator? No, but you probably want one. Self-hosting skips the facilitator's KYB, outages, and missing chains. The cost is running it all yourself: a connection to each blockchain, a wallet to cover your transaction fees, and code that waits for transfer to confirm.

Can the facilitator tamper with anything? No, the payload is signed. A bad actor could still lie about whether the settlement succeeded though.

How does the server know it can serve the gated content? It POSTs the signed payload to the facilitator's /settle and waits for the answer. The facilitator broadcasts the transfer, waits for the chain to confirm it, about 2 seconds on Base, then replies. On success the server serves the content.

Is this crypto-only? Mostly, but not strictly. The common exact scheme always settles on a blockchain. The batch-settlement scheme also has a Cloudflare binding that is pure fiat: the asset is USD, Cloudflare is merchant of record, and the crawler signs with HTTP Message Signatures instead of a wallet key, then gets invoiced.

Does x402 protect the gated content? No. x402 says nothing about what happens to the content afterwards. The industry answer so far is provenance instead of prevention: Capture wraps C2PA-signed images in an x402 endpoint and mints a receipt tying agent to asset to licence terms. For example, a photo archive selling to AI trainers, where the job is proving the purchase was licensed rather than preventing the "illegal" copy.

Thoughts 🧠

✅ Why use - No account, no API key, no legal contract and no licensing deal required. A crawler that has never met you pays for one request and gets the bytes, and you price per URL. It is one standard, so a buyer integrates once and can pay any x402 seller the same way.
🙅 Why not - You still probably depend on a facilitator, and every one tested had serious security holes. Payment is nearly always stablecoins, so your buyer needs to use crypto. Payment is final too: no chargeback, no dispute window, so a seller who takes the money and serves nothing leaves you stranded. And the economy is tiny: filtering out wash trading, Visa and Artemis put the protocol's entire lifetime at $15 million. It doesn't seem to be the right tool for large payments.
⚔️ Players - AWS WAF AI traffic monetization (GA, CloudFront-attached, USDC on Base and Solana, standard WAF pricing), Cloudflare Monetization Gateway (waitlist only, x402 at the edge, no pricing disclosed), the x402 reference stack (Apache-2.0, TS/Python/Go/Java middleware, ships a self-facilitation example), x402-rs (Apache-2.0, Rust facilitator you host yourself, public Docker image), Coinbase's CDP facilitator (managed, 1,000 on-chain settlements/month free, then $0.001 each), pay.sh (Solana Foundation, MIT, one CLI that speaks x402, MPP and AP2), and on the buying side ClawRouter (MIT, LLM router for agents, USDC on Base and Solana, no account) and AgentCash (one wallet balance across paid APIs, hosted, signup required).
🔮 Prediction - The pipes work. Almost nobody is sending money through them. What I actually wonder is whether this ever escapes the crypto crowd. Somebody still has to build a consumer UX worth using, and until then my bet is the real demand is B2B/Agents buying data, which mostly means somebody feeding an LLM with paid-context. I have tried using Agentcash but almost didn't get past all the on-boarding hassles - seemed like most data providers were half-baked.