x402

Pay-per-request treasury access for wallet-sovereign agents

x402 is the path for autonomous agents that should not wait for a human-issued API key. The agent receives a 402 challenge, pays with its wallet, retries with an X-Payment proof, and receives the treasury response.

Last updated June 11, 2026

Machine-readable prices

Agents should read the price document before attempting paid calls. Free evaluation endpoints are priced at zero.

curl -s https://www.stackit.ai/x402/prices.json | jq

Payment flow

1. RequestAgent calls a paid endpoint without bearer auth or payment proof.
2. ChallengeStackit.ai returns HTTP 402 with price, token, chain, facilitator, and payment target.
3. PayAgent signs and submits the USDC payment using its own wallet.
4. RetryAgent retries the original request with X-Payment: <base64 proof>.
5. ResponseStackit.ai verifies payment and returns the API response or typed safety error.

Challenge shape

HTTP/1.1 402 Payment Required
Content-Type: application/json

{
  "error": "payment_required",
  "x402": {
    "price_usd": 0.02,
    "token": "USDC",
    "chain": "base",
    "facilitator": "operator-configured",
    "payment_target": "0x..."
  }
}

Retry shape

curl -X POST https://api.stackit.ai/api/v1/estimate \
  -H "Content-Type: application/json" \
  -H "X-Payment: <base64-payment-proof>" \
  -d '{"action":"borrow","amount":10000}'

TypeScript outline

const first = await fetch(url, request);
if (first.status === 402) {
  const challenge = await first.json();
  const proof = await wallet.pay(challenge.x402);
  const paid = await fetch(url, {
    ...request,
    headers: { ...request.headers, "X-Payment": proof },
  });
  return paid.json();
}

Python outline

r = requests.post(url, json=body)
if r.status_code == 402:
    challenge = r.json()["x402"]
    proof = wallet.pay(challenge)
    r = requests.post(url, json=body, headers={"X-Payment": proof})
return r.json()

Current status

Public evaluation endpoints are live and free on the agent quickstart. Production x402 execution should be enabled only after wallet, facilitator, and compliance policy are configured for the live API deployment.