The x402 protocol,
governed.
x402 v2 makes HTTP 402 real: agents paying for resources in USDC, per request, in seconds. Sumway implements the protocol on both sides — with policy limits, optional signed-agent verification, and a tamper-evident audit record.
The protocol in 30 seconds
Three steps.
Three headers.
402 + PAYMENT-REQUIRED
An agent requests a paid resource. The server answers HTTP 402 with a PAYMENT-REQUIRED header containing a v2 challenge: price, asset (USDC), recipient address, and CAIP-2 settlement network.
PAYMENT-SIGNATURE
The agent retries with a PAYMENT-SIGNATURE header carrying a signed EIP-3009 authorization — a gasless USDC transfer the seller can settle without holding the buyer's keys.
200 OK + PAYMENT-RESPONSE
The seller verifies the signature, settles through a facilitator, and serves the content with a PAYMENT-RESPONSE receipt. Sub-cent payments, seconds to settle.
The mapping
What x402 specifies.
What Sumway adds.
The protocol defines the wire format. It deliberately says nothing about who may spend, how much, on whose authority, or how you prove it later. That silence is where Sumway lives.
x402 protocol
Price, asset, and payTo advertised per resource
Sumway kernel
Per-route price table; payTo is operator-configured. Use dedicated treasury or revenue addresses in production.
x402 protocol
Signed EIP-3009 USDC authorization
Sumway kernel
The gateway’s configured signing key signs after policy checks; agents never receive that key. Managed or HSM-backed custody is required for production deployment.
x402 protocol
Not specified by the protocol
Sumway kernel
CAP_X402_OUT gates x402 micropayments separately from wire/ACH; no capability → blocked and written to the ledger
x402 protocol
Not specified by the protocol
Sumway kernel
Atomic per-agent spend ceilings with reservations — concurrent payments cannot race past a cap; micro-unit money, no float
x402 protocol
Any valid signature is a valid payer
Sumway kernel
Optional Know-Your-Agent verification checks the signed agent request before settlement. Binding an agent identity to the settling payer address is a planned control.
x402 protocol
Seller settles via facilitator, then serves
Sumway kernel
Settle-before-serve, fail-closed: no settled payment and durable audit record → no content, ever
x402 protocol
Nonce embedded in the authorization
Sumway kernel
Settled-nonce store: replays are rejected; a same-nonce retry after a failed audit write recovers the stuck settlement and serves
x402 protocol
Pay per request
Sumway kernel
Credit packs purchased over x402 itself — prepaid credits drawn down per request, every sale on the ledger
x402 protocol
Buyer picks an endpoint
Sumway kernel
Ranked provider selection under kernel caps — agents automatically pay the cheapest qualifying seller
x402 protocol
PAYMENT-RESPONSE receipt
Sumway kernel
SHA-256 hash-chained ledger entry for every decision; revenue is a distinct ledger action that never counts against spend ceilings
Both sides of the transaction
Buying and selling,
end to end.
API surface
Four endpoints.
Whole economy.
Agents integrate by calling the kernel — they never hold keys, never talk to a facilitator, never see a nonce. Sellers integrate by wrapping any HTTP handler with the paywall middleware and a price table.
/v1/x402/fetchBuy side — fetch a paid resource through the kernel wallet, under capability and ceiling checks
/v1/x402/budgetBuy side — an agent's remaining spend ceiling and reservation state
/v1/x402/packs/:idSell side — purchase a credit pack over x402; credits draw down on later requests
/v1/x402/revenueSell side — settled paywall earnings, backed by revenue entries on the ledger
The invariants
If a payment can't be proven,
it didn't happen.
Everything above is subordinate to one rule: no durable audit record, no resource. A path that serves paid content without a settled, audited payment is a design bug — not a feature.
Settle-before-serve: a request that fails facilitator settlement gets a fresh 402, never the content.
If settlement succeeds but the audit write fails, the paywall returns 500 and does not serve — the buyer's same-nonce retry recovers and serves once the record exists.
Revenue entries use a distinct ledger action: paywall earnings can never be confused with agent spend or count against any ceiling.
No capability, no ceiling headroom, or failed required identity verification → the payment does not fire, and the block is written to the hash-chained ledger.
Put your first endpoint
behind a 402.
Sumway is in private deployment. If you're building in the x402 ecosystem — buying, selling, or both — we'd like to talk.