---
title: "Learn x402: agentic payment security guides | Settlens"
description: "How x402 agentic payments work and how to secure them: V2 headers, V1 migration, EIP-3009, agent spending policies, facilitator security and error codes."
url: https://settlens.com/learn
last_updated: 2026-10-13
---

# Learn x402

> **In short:** Settlens' x402 guides explain how agentic payments over HTTP 402 work and how to secure them: the protocol and its V2 headers, migrating from V1, EIP-3009 signatures, a security checklist, agent spending policies, facilitator security, error codes and a glossary, each citing the specifications.

x402 lets software pay for an HTTP resource over HTTP itself: the server answers 402 with machine-readable terms and the client retries with a signed payment. These guides explain how the protocol works, field by field, and what has to hold for an agent to pay safely, with links to the specifications they paraphrase.

[Start with What is x402?](https://settlens.com/learn/what-is-x402) [Open the security checklist](https://settlens.com/learn/x402-security-checklist)

_Diagram: Diagram of the x402 roles: the client requests a resource and receives 402 with PAYMENT-REQUIRED, retries with PAYMENT-SIGNATURE, the resource server calls the facilitator's /verify and /settle, then returns 200 with PAYMENT-RESPONSE._

_The three x402 roles and the messages between them, in order._

## Recommended reading path

Read in this order if x402 is new to you. Each guide builds on the previous one.

- **[1. What is x402?](https://settlens.com/learn/what-is-x402)**

  The roles, the 402 handshake step by step, payment flows, schemes, CAIP-2 networks and how V2 differs from V1.

- **[2. x402 V2 headers](https://settlens.com/learn/x402-v2-headers)**

  Every field of PAYMENT-REQUIRED, PAYMENT-SIGNATURE and PAYMENT-RESPONSE, with decoded examples and the validation mistakes that matter.

- **[3. V1 to V2 migration](https://settlens.com/learn/x402-v1-to-v2-migration)**

  What changed between V1 and V2 on the wire, the steps for servers, clients and facilitators, and how to confirm a migration shipped.

- **[4. EIP-3009](https://settlens.com/learn/eip-3009)**

  How the payer's signature is built and bound to the token, chain, recipient and amount, and what only the chain can confirm.

- **[5. Security checklist](https://settlens.com/learn/x402-security-checklist)**

  Controls for resource servers, facilitators and agents, mapped to the Settlens checks that test them where one exists.

- **[6. Agent spending policy](https://settlens.com/learn/agent-spending-policy)**

  The limits an agent should check before it signs, how they turn into pay, review or do_not_pay, and what a per-request policy cannot cover.

- **[7. Facilitator security](https://settlens.com/learn/x402-facilitator-security)**

  How /verify, /settle and /supported work, the ways they fail, and what an outside test can and cannot prove.

- **[8. Error codes](https://settlens.com/learn/x402-error-codes)**

  Every error code of the V2 specification, with the fix and the Settlens check that detects the cause where one exists.

- **[9. Glossary](https://settlens.com/learn/glossary)**

  Keep it open as a reference while you read the others.

## Put it into practice

The guides paraphrase the specifications listed under Sources: when they disagree with a guide, the specification wins. To run the same checks:

- **[Assess an endpoint](https://settlens.com/product/assess)**

  Run the passive checks from these guides against a paid resource, without paying.

- **[Verify a signature](https://settlens.com/product/verify)**

  Recover the EIP-3009 signer and check its binding offline, with no RPC or key.

- **[Check before paying](https://settlens.com/mcp)**

  Give an AI agent the same checks through the Settlens MCP server.

- **[Quickstart](https://settlens.com/docs/quickstart)**

  Install the CLI as a pilot participant and run your first scan.

[Try the free x402 tools](https://settlens.com/tools)

## Check your own x402 endpoints

A scoped pilot on one paid endpoint or facilitator, with a report your engineers and partners can verify.

[Request a pilot](https://settlens.com/contact) [Explore the MCP server](https://settlens.com/mcp)

## Sources

1. [x402 protocol specification, version 2](https://github.com/x402-foundation/x402/blob/main/specs/x402-specification-v2.md) — x402 Foundation
2. [x402 HTTP transport, version 2](https://github.com/x402-foundation/x402/blob/main/specs/transports-v2/http.md) — x402 Foundation
3. [ERC-3009: Transfer With Authorization](https://eips.ethereum.org/EIPS/eip-3009) — Ethereum Improvement Proposals