Skip to main content
The X402 protocol is a payment-aware HTTP extension that enables AI agents to require and verify payments for API access. This guide provides a complete overview of X402 implementation in the Nevermined Payments Library.

Overview of X402

X402 is an HTTP-based protocol for payment-protected resources:
  • 402 Payment Required: HTTP status code for payment requests
  • PAYMENT-SIGNATURE: Header containing payment credentials (X402 v2)
  • PAYMENT-REQUIRED: Header with payment requirements in 402 responses
  • PAYMENT-RESPONSE: Header with payment settlement details in success responses
  • Cryptographic Signatures: ERC-4337 account abstraction for secure payments

Supported Schemes

Nevermined supports two x402 payment schemes: The scheme is determined by the plan’s pricing configuration. Plans with isCrypto: false use nvm:card-delegation; all others use nvm:erc4337. For card-delegation plans, the network is derived from the plan’s fiatPaymentProvider metadata ('stripe' or 'braintree'). The SDK auto-detects both via resolveScheme() / resolveNetwork().

X402 Version 2 Specification

The Nevermined Payments Library implements X402 v2, which uses:
  • PAYMENT-SIGNATURE header for access tokens (replaces Authorization)
  • PAYMENT-REQUIRED header for payment requirements (replaces custom formats)
  • PAYMENT-RESPONSE header for settlement receipts
  • Structured payment credentials with cryptographic signatures

Generate X402 Access Tokens

Subscribers generate access tokens to query agents:

Generate Tokens via Nevermined App

Users can also generate X402 access tokens through the Nevermined App:
  1. Visit nevermined.app/permissions/agent-permissions
  2. Select the plan you’ve purchased
  3. Configure token parameters (agent, expiration, limits)
  4. Generate and copy the X402 access token
  5. Use the token in API requests
This provides a user-friendly interface for non-technical users to generate tokens without code.

Generate Card-Delegation Tokens

For fiat plans using nvm:card-delegation, pass X402TokenOptions with a CardDelegationConfig:

Reusing Existing Delegations

Instead of creating a new delegation on every token request, you can reuse an existing delegation by passing its delegationId. This is useful when running multiple agents that should share a single spending budget:
When delegationId is provided, the backend verifies that the delegation is active and that the requesting API key has access, then returns its existing token without creating a new delegation.

Specifying a Card

You can target a specific enrolled card using cardId. The backend will look for an active delegation on that card or create a new one:

Auto-Selection

When neither cardId nor delegationId is specified (and providerPaymentMethodId is omitted), the backend automatically selects the best card and delegation for the requesting API key. It finds cards accessible to the API key, looks for active delegations with remaining budget, and reuses one if available — otherwise creates a new delegation:

CardDelegationConfig Reference

* Required when creating a new delegation. Ignored when reusing an existing one via delegationId.

Auto Scheme Resolution

Use resolveScheme() to auto-detect the correct scheme from plan metadata:

DelegationAPI

Manage payment methods and delegations for card delegation:

Update Payment Method

Restrict a card to specific NVM API Keys so only designated agents can use it:

List Delegations

Retrieve all delegations for the authenticated user:

DelegationListResponse Fields

listDelegations() resolves to a DelegationListResponse object:

DelegationSummary Fields

Each item in the delegations array is a DelegationSummary:

PaymentMethodSummary Fields

X402 Access Token Structure

The access token is a JWT containing an X402 v2 payment credential:

Card-Delegation Token Structure

For fiat plans using nvm:card-delegation, the token contains a JWT-based delegation authorization:

Token Components

  • x402Version: Protocol version (2 for current spec)
  • accepted: Payment method specification
    • scheme: nvm:erc4337 for crypto or nvm:card-delegation for fiat
    • network: eip155:84532 (Base Sepolia) for crypto, stripe or braintree for fiat (matches the plan’s fiatPaymentProvider metadata)
    • planId: The payment plan being used
    • extra: Additional metadata (version, agentId, etc.)
  • payload: Payment authorization
    • signature (erc4337): Cryptographic proof of payment authorization
    • token (card-delegation): Signed JWT encoding the delegation claims
    • authorization: Subscriber identity and session keys
  • extensions: Optional protocol extensions

Verify X402 Permissions

Agents verify tokens before executing requests:

Verification Response

Settle X402 Permissions

After successful execution, burn credits:

Settlement Response

HTTP Headers (X402 v2)

PAYMENT-SIGNATURE Header

Subscribers include this header in requests:

PAYMENT-REQUIRED Header (402 Response)

Agents return this header when payment is required:
The header contains base64-encoded payment requirement JSON. The scheme and network vary by plan type: Crypto plan:
Fiat plan:

PAYMENT-RESPONSE Header (Success)

Agents include this header in successful responses:
The header contains base64-encoded settlement details:

Complete X402 Flow

Subscriber Side

Agent Side

buildPaymentRequired Helper

Simplifies creating X402PaymentRequired objects:
When scheme is set to 'nvm:card-delegation', the network is auto-resolved from the plan’s fiatPaymentProvider metadata — either 'stripe' or 'braintree'. Pass network explicitly to override.

Best Practices

  1. Always Verify Before Execute: Never skip token verification
  2. Settle After Success: Only burn credits after successful execution
  3. Use X402 v2 Headers: Prefer PAYMENT-SIGNATURE over Authorization
  4. Return 402 Properly: Include PAYMENT-REQUIRED header with details
  5. Log Transactions: Record settlement transaction hashes
  6. Handle Errors: Provide clear error messages in 402 responses
  7. Token Reuse: Subscribers can reuse tokens for multiple requests
  8. Restrict Cards to API Keys: When running multiple agents, restrict each card to specific NVM API Keys using allowedApiKeyIds to prevent unauthorized spending
  9. Reuse Delegations: Pass delegationId to reuse existing delegations instead of creating new ones on each request — this avoids delegation sprawl and keeps spending consolidated

Source References:
  • src/x402/token.ts (getX402AccessToken)
  • src/x402/delegation-api.ts (DelegationAPI: listPaymentMethods, listDelegations, updatePaymentMethod)
  • src/x402/facilitator-api.ts (verifyPermissions, settlePermissions, buildPaymentRequired)
  • tests/e2e/test_x402_e2e.test.ts (complete X402 flow)