AI Summary: x402 activates HTTP 402 for per-request payments: a server declares payment requirements, a client returns signed payment proof, and a facilitator can verify and settle before the resource is delivered. It can support machine-facing pricing, but payment does not grant unlimited scraping rights, prove content ownership, or guarantee revenue or AI visibility.
What x402 changes
HTTP 402 Payment Required is a standard response status that has rarely been used for payments. The x402 protocol documentation uses it to tell a client that a resource requires payment and to provide the information needed to pay programmatically. [1] The result is a request-level handshake rather than a checkout page or a long-lived subscription.
In x402 version 2, PAYMENT-REQUIRED carries a Base64-encoded payment requirement from server to client, and PAYMENT-SIGNATURE carries the client's signed payment authorization back. [1] A header is transport, not authorization: the resource server still decides what the buyer may receive and whether payment has been verified.
Model the seller's contract
Coinbase documents this flow: request, 402 with price and options, signed retry, facilitator verification, server work, settlement, and resource response. [2] Define price, asset, network, recipient, expiry, idempotency, and timeout behavior.
Payment should buy a stated service, not an undefined right to copy a site. Publish usage, license, robots, data, rate, refund, and abuse terms. Do not reveal paid content before verification and delivery policy allow it.
| Concern | Evidence to verify |
|---|---|
| Pricing | Amount, asset, network, recipient, and expiry are explicit |
| Verification | Invalid, expired, replayed, and wrong-recipient proofs fail closed |
| Delivery | Resource is released only after the intended payment state |
| Reliability | Timeouts, duplicate requests, and facilitator failures are recoverable |
| Rights | Payment terms define permitted use; they do not imply unlimited scraping |
Verification checklist
Run sandbox requests for unpaid, valid, expired, replayed, and insufficient payment. Decode headers only in a test harness; malformed data must fail before business logic. Log outcomes without private keys or payment secrets.
x402 makes a machine-facing price legible; it does not make a buyer trustworthy or turn payment into an AI citation.