x402 in 60 seconds

x402 is an open payment protocol that turns the long-unused HTTP 402 Payment Required status code into a machine-readable checkout. It is not a marketplace. It is the payment rail that makes a marketplace possible.

The flow

1. An agent calls a paid endpoint without payment.
2. The server returns 402 with a PAYMENT-REQUIRED header. The header is base64-encoded JSON. The body usually repeats it for compatibility.
3. The quote contains an accepts array: scheme, network, asset, amount, payTo and maxTimeoutSeconds.
4. The agent signs a payment authorization. On Base with USDC, that is usually EIP-3009 transferWithAuthorization.
5. The agent retries with a PAYMENT-SIGNATURE header.
6. The server verifies the payment, usually through a facilitator's /verify endpoint.
7. The server runs the request.
8. The server settles through the facilitator's /settle endpoint.
9. The server returns the data with a PAYMENT-RESPONSE header and, ideally, a receipt.

The provider is paid directly. A facilitator is non-custodial: it verifies and submits the transfer, it does not hold the money.

A real quote

{
  "x402Version": 2,
  "error": "Payment required",
  "resource": {
    "url": "https://api.example.com/v1/zip/10001",
    "description": "US ZIP code lookup"
  },
  "accepts": [{
    "scheme": "exact",
    "network": "eip155:8453",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "1000",
    "payTo": "0xYourWallet",
    "maxTimeoutSeconds": 300,
    "extra": { "name": "USD Coin", "version": "2" }
  }]
}

amount is in atomic units. USDC has six decimals, so 1000 is 0.001 USDC.

The most common misunderstanding

A valid 402 does not prove delivery. Anyone can return a payment challenge. The important question is whether the API returns real product after the payment settles.

The default flow should be:

verify payment → run the request → settle → return data

If the upstream returns a 4xx or 5xx, the route should return an error, not a 200 with an empty body. If the route settles before running, label it clearly. A buyer cannot charge back an on-chain payment, so the seller has to earn trust before the first call.

Facilitators and Bazaar

A facilitator verifies and settles. Coinbase's CDP Facilitator is the most common production option for Base. PayAI, thirdweb, Corbits and others cover more networks. You can also self-facilitate, but you then own RPC reliability, gas wallets and compliance.

The x402 Bazaar is the discovery extension. A resource declares input and output metadata in its 402. A facilitator indexes it after a settled payment. That is how public discovery catalogues populate themselves.

What to remember

• x402 is a payment protocol, not a directory.
• Base + USDC is the default path.
• Discovery should be free; payment happens on the provider's route.
• Settle after success.
• Publish receipts.
• Price, network and wallet must be readable before payment.

These five practices put a listing ahead of most x402 catalogues.