Learn x402
x402 lets software pay for an HTTP resource over HTTP itself: the server answers 402 with machine-readable terms and the client retries with a signed payment. These guides explain how the protocol works, field by field, and what has to hold for an agent to pay safely, with links to the specifications they paraphrase.
In short
Settlens' x402 guides explain how agentic payments over HTTP 402 work and how to secure them: the protocol and its V2 headers, migrating from V1, EIP-3009 signatures, a security checklist, agent spending policies, facilitator security, error codes and a glossary, each citing the specifications.
Recommended reading path
Read in this order if x402 is new to you. Each guide builds on the previous one.
-
1. What is x402?
The roles, the 402 handshake step by step, payment flows, schemes, CAIP-2 networks and how V2 differs from V1.
-
2. x402 V2 headers
Every field of PAYMENT-REQUIRED, PAYMENT-SIGNATURE and PAYMENT-RESPONSE, with decoded examples and the validation mistakes that matter.
-
3. V1 to V2 migration
What changed between V1 and V2 on the wire, the steps for servers, clients and facilitators, and how to confirm a migration shipped.
-
4. EIP-3009
How the payer's signature is built and bound to the token, chain, recipient and amount, and what only the chain can confirm.
-
5. Security checklist
Controls for resource servers, facilitators and agents, mapped to the Settlens checks that test them where one exists.
-
6. Agent spending policy
The limits an agent should check before it signs, how they turn into pay, review or do_not_pay, and what a per-request policy cannot cover.
-
7. Facilitator security
How /verify, /settle and /supported work, the ways they fail, and what an outside test can and cannot prove.
-
8. Error codes
Every error code of the V2 specification, with the fix and the Settlens check that detects the cause where one exists.
-
9. Glossary
Keep it open as a reference while you read the others.
Put it into practice
The guides paraphrase the specifications listed under Sources: when they disagree with a guide, the specification wins. To run the same checks:
-
Assess an endpoint
Run the passive checks from these guides against a paid resource, without paying.
-
Verify a signature
Recover the EIP-3009 signer and check its binding offline, with no RPC or key.
-
Check before paying
Give an AI agent the same checks through the Settlens MCP server.
-
Quickstart
Install the CLI as a pilot participant and run your first scan.
Sources
Check your own x402 endpoints
A scoped pilot on one paid endpoint or facilitator, with a report your engineers and partners can verify.