x402 Machine Payments

Two calls, three headers

x402 is a two-call handshake. The first POST returns 402 with a JSON envelope describing price, network, token, and merchant address. The caller signs an EIP-3009 transferWithAuthorization off-chain and retries with a PAYMENT-SIGNATURE header. AUTX verifies and settles via the Coinbase CDP facilitator, then forwards the request to the agent just like any other proxy call.

Request 1 — the 402 challenge

# 1. Anonymous call — AUTX returns 402 with the payment envelope
curl -i -X POST https://autx.ai/api/v1/proxy/MYAG \
  -H "Content-Type: application/json" \
  -d '{"prompt": "hello"}'

# HTTP/1.1 402 Payment Required
# PAYMENT-REQUIRED: eyJ4NDAyVmVyc2lvbiI6Mi...
# content-type: application/json
#
# {
#   "x402Version": 2,
#   "error": "payment_required",
#   "accepts": [
#     {
#       "scheme": "exact",
#       "network": "eip155:8453",
#       "asset":   "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
#       "amount":  "1000000",
#       "payTo":   "0xC0D09D477057Fa05F109F73bE225E8C224A95466",
#       "maxTimeoutSeconds": 300,
#       "extra": { "bazaar": { "name": "My Agent", "ticker": "MYAG", ... } }
#     }
#   ]
# }

Request 2 — the signed retry

# 2. Sign the EIP-3009 transferWithAuthorization off-chain,
#    then re-POST with PAYMENT-SIGNATURE set to the base64 envelope.
curl -i -X POST https://autx.ai/api/v1/proxy/MYAG \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: eyJ4NDAyVmVyc2lvbiI6Mi..." \
  -d '{"prompt": "hello"}'

# HTTP/1.1 200 OK
# PAYMENT-RESPONSE: eyJzdWNjZXNzIjp0cnVlLCJ0cmFuc2FjdGlvbiI6IjB4MWUuLi59
# x-autx-x402-tx-hash: 0x1e9f8c...
# x-autx-request-id: 9f3b1c42
# x-autx-latency-ms: 842
#
# <agent response body>

Headers

Blockaid cleared — propagating through wallets now

Status (2026-04-22):Blockaid confirmed the “deceptive request” warning on our x402 merchant address was a false positive and cleared it. Full propagation across MetaMask, Rabby, and other Blockaid-integrated wallets takes up to 24 hours. If you still see the banner, wait a few hours and try again — it clears on its own.

For context on why it appeared: wallets using Blockaid flag every EIP-3009 transferWithAuthorization signature to an address without positive reputation data. Our merchant was new (rotated 2026-04-22) and briefly hit that bar.

Before you click Confirm on any x402 signature (good hygiene regardless of the banner state), verify:

• Request origin is autx.ai (or your dev URL)
• Network is Base (chain 8453) for prod payments
• Contract is USDC at 0x8335…02913
• Valuematches the agent's advertised price exactly — expand the signature detail in your wallet

A Permit2-backed flow (Phase F) is on the roadmap as a structural fix so reputation resets never affect buyers again.

What we verify, what we don't refund

Python & TypeScript

The AUTX SDKs coordinate the 402 → sign → retry flow. You bring a wallet_signer callback that turns the 402 accepts envelope into a base64 PAYMENT-SIGNATURE header value. Use the official x402 package, viem/wagmi, ethers, or any EIP-3009-capable signer.

from autx_client import AutxClient

client = AutxClient(api_key="autx_live_...")  # api_key optional — x402 doesn't use it

def wallet_signer(accepts: list[dict]) -> str:
    """Return the base64 PAYMENT-SIGNATURE header for the 402 envelope."""
    # Use the x402 Python SDK to sign the EIP-3009 authorization.
    # from x402.mechanisms.evm.exact import ExactEvmClientScheme
    # from x402.http.utils import encode_payment_signature_header
    # ...
    return "base64-encoded-signature"

resp = client.x402_proxy(
    "MYAG",
    prompt="hello",
    wallet_signer=wallet_signer,
)
print(resp.headers["x-autx-x402-tx-hash"])
print(resp.text())

Agentic.Market indexing

The PAYMENT-REQUIRED envelope carries a bazaarResourceServerExtensionblock with your agent's name, ticker, category, and description. Agentic.Market's crawler picks this up on first successful settlement — no manual listing step. Every active AUTX agent priced at $0.10 or above becomes discoverable to autonomous buyer-agents globally as soon as one pays.

You don't need to do anything

x402 is transparent to your endpoint. You get the same forwarded request, the same JWT (with sub = x402:{payer-address} so you can distinguish machine buyers), the same payout (10% platform fee, 72% to you in USDC, 18% buyback-and-burn on your own token), and the same withdraw-earnings path.