HTTP status code 402 sat reserved in the spec for thirty years. "Payment Required." Nobody used it because there was no way to pay. This morning our API started answering with it, and the answer includes real payment terms that any AI agent with a wallet can settle in about two seconds.
Here is what we shipped, what broke, and what it actually costs, because most write-ups about the agent economy skip the part where you find out the discovery document format you implemented was deprecated before lunch.
What x402 is, in one paragraph
x402 is an open protocol that finally operationalizes HTTP 402. A client requests a resource. The server replies 402 with machine-readable terms: price, asset, network, receiving wallet. The client signs a stablecoin transfer authorization, retries the request with the signature in a header, and the server verifies and settles on-chain before serving the response. No accounts, no API keys, no subscriptions. It exists because AI agents need to buy things per-request, and the credit card stack was never built for a customer that makes four hundred purchases an hour at half a cent each.
What we built
Our product is The Nervous System, an external governance layer for agent systems. Governance and attribution are the missing layer of agent commerce: when autonomous systems act and transact, someone has to be able to prove what happened, in what order, authorized by whom. So the first thing we sold over x402 is exactly that: a read-only verification call against a live governance audit chain.
The stack, end to end:
A paywall service that answers 402 with the payment terms and, on a paid retry, verifies and settles before proxying the upstream call. A self-hosted facilitator in Node using viem: it recovers the EIP-712 signature from the EIP-3009 transferWithAuthorization payload, checks the terms, and broadcasts the USDC transfer on Base from a small gas wallet. Settlement lands directly in our wallet. No hosted payment processor, no fixed monthly fee, no percentage cut beyond network gas.
That last part was a deliberate decision. The first facilitator we evaluated charged a monthly minimum that would have required roughly twenty thousand paid calls a month just to break even on a half-cent endpoint. Fixed costs are poison for pre-revenue experiments. Self-hosting the facilitator took one build session and its marginal cost is gas.
The part where the spec moved under us
We shipped a compliant x402 v1 paywall, verified it against the published schema, and submitted it to x402scan, the ecosystem explorer where agents discover paid endpoints. Rejected: v1 response detected, v2 only.
The v2 migration is real but contained. The 402 body restructures (a resource object, CAIP-2 network identifiers like eip155:8453 instead of "base", amount instead of maxAmountRequired), the payment header changes name, and the response should also carry the terms base64-encoded in a PAYMENT-REQUIRED header. The signed authorization inside the payment is identical between versions, so our facilitator did not change at all. We kept v1 header compatibility so older clients still settle. One LLM agent did the migration against a written spec, twelve tests, same morning.
Second surprise: the discovery document. We implemented /.well-known/x402 and then read the indexer source and found a comment saying that path is legacy and no longer parsed. The convention that won is OpenAPI-first: serve /openapi.json with an x-payment-info block per operation. We validated ours with the same engine the registry runs before submitting. If you are building on a young protocol, read the validator source, not the blog posts. Including this one.
Where you can find it
The endpoint is discoverable on x402scan, on 402 Index (registered and domain-verified in one API call, which was refreshingly boring), and through the marketplaces that syndicate those indexes. The origin serves /openapi.json and /llms.txt so anything crawling for payable resources finds the terms without a registry at all.
Today we added a second, more useful product: a governance lint for MCP server configurations. POST your MCP config, get back deterministic findings with severities and a score: plaintext secrets in env blocks, unpinned packages pulled with auto-install flags, filesystem servers scoped to root, non-TLS remote transports. Five cents per call. It is the same class of check we run inside The Nervous System, packaged for any agent that wants to audit its own toolchain before trusting it.
- GET https://api.100levelup.com/x402/verify-audit ($0.005) - audit-chain verification
- POST https://api.100levelup.com/x402/audit-mcp ($0.05) - MCP config governance lint
- https://api.100levelup.com/openapi.json - terms and schemas
The honest ledger
Infrastructure: live. Listings: live. Real money settled: not yet, and we are saying so on purpose. A live 402 and a proven settlement are different claims, and conflating them is how this space gets a bad name. The first agent that pays will produce a BaseScan transaction hash, and that hash is the moment this becomes a payments story instead of an infrastructure story.
The unit economics are also worth stating plainly. Half-cent calls are not a business by themselves; they are rails. The business is what the rails prove: that a two-person operation with an LLM partner can stand up production payment infrastructure, migrate a protocol version, and list on the discovery layer of the agent economy in a single day. That capability is the product. The endpoints are the demo that never stops running.
Built by Arthur Palyan dba Levels Of Self. The Nervous System is our governance layer for agent systems; if your organization is deploying agents and needs the audit trail to prove what they did, that is the conversation we want to have: https://levelsofself.com
Top comments (0)