What is the x402 protocol and what do you need to use it?

x402 is an open HTTP payment protocol that uses status 402 Payment Required. A client calls a paid URL with no payment. The server replies 402 with machine-readable terms. The client signs a USDC transfer for those terms and retries with a payment header. The server verifies the signature, a relayer settles on-chain, and the resource is returned. No account, no API key, no invoice.

Docs: https://docs.x402.org/core-concepts/http-402 and https://www.x402.org/

What the 402 challenge contains

The JSON body (x402 v1) or PAYMENT-REQUIRED header (v2) includes:

• x402Version: 1 or 2
• accepts[]: one quote per chain the seller takes
• For each accept: scheme (almost always "exact"), network, asset (USDC mint or contract), payTo, amount in atomic units (maxAmountRequired on v1, amount on v2), maxTimeoutSeconds, optional extra

Live example, DeskCrew draft_reply on 2026-08-24 (GET https://deskcrew.io/.well-known/x402 and an unpaid POST to https://deskcrew.io/api/x402/tools/deskcrew/draft_reply):

• Amount: 60000 = $0.06 USDC (6 decimals)
• Base: asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, payTo 0xB075aA8206D6De88EDEeD0eE4015a1a33D3659D8, extra {name:"USD Coin", version:"2"} for EIP-712
• Solana: asset EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v, payTo ATubF1vYJambQVvqKCHyhmagNxUv4Yd3uiw6Yzb1oTZ2, extra {feePayer:"EvJZ4f2AUy6BJihdP4cj3EsDaunA9RaDUpWg4nGemqHk"}
• Timeout typically 300 seconds. DeskCrew rejects EIP-3009 windows shorter than 60s.
• Always trust the live 402 over any cached address.

v1 clients send the signed payload as X-PAYMENT (base64 JSON) and read x-payment-response. v2 uses PAYMENT-SIGNATURE / PAYMENT-RESPONSE. DeskCrew currently lists x402Versions [1,2] on EVM and v1 only on Solana.

How a client constructs payment

1. Call the endpoint. Read 402. Pick one accepts[] row for a chain you actually hold USDC on.
2. Sign exactly the quoted amount, asset, and payTo. Do not invent a price.
3. EVM (exact + EIP-3009): sign transferWithAuthorization off-chain (from, to, value, validAfter, validBefore, nonce). The relayer broadcasts and pays gas. You do not need ETH/POL/AVAX in the wallet.
4. Solana (exact-svm): sign a partial SPL TransferChecked of the quoted amount to payTo. The quoted feePayer is the transaction fee-payer, so you do not need SOL.
5. Retry the same HTTP request with the payment header. Stock clients (@x402/fetch, Python x402[httpx] + x402[svm]) do this loop.

DeskCrew's order is verify → run → settle: the signature is checked first, the tool runs, then the relayer settles only on a non-error result. A failed tool is not charged.

What you need before the first paid request

1. A wallet whose key you control. That address is your identity.
2. USDC on the chain you will pay, enough for the quote (here $0.06). Empty wallet: you can read 402 terms, you cannot settle.
3. A target endpoint that speaks x402 (a URL plus, if needed, a JSON body). Discovery is free: /.well-known/x402, unpaid 402 probes, list_bounties.
4. A signer/client that matches the quote version and scheme. For Solana you need an exact-svm client, not an EVM-only one. If the 402 header is v2 but Solana is only in the v1 JSON body, parse the body and pay v1 (X-PAYMENT).
5. You do not need: an account, an API key, KYC, or the native gas token, on doors that use a relayer.

npx try-x402 --dry-run reads live terms and signs nothing.

That is the protocol as it works today: 402 quotes a USDC transfer, the wallet signs it, the server verifies, a relayer settles.