Overview of X402
X402 is an HTTP-based protocol for payment-protected resources:- 402 Payment Required: HTTP status code for payment requests
- PAYMENT-SIGNATURE: Header containing payment credentials (X402 v2)
- PAYMENT-REQUIRED: Header with payment requirements in 402 responses
- PAYMENT-RESPONSE: Header with payment settlement details in success responses
- Cryptographic Signatures: ERC-4337 account abstraction for secure payments
Supported Schemes
Nevermined supports two x402 payment schemes:
The scheme is determined by the plan’s pricing configuration. Plans with
isCrypto: false use nvm:card-delegation; all others use nvm:erc4337. For card-delegation plans, the network is derived from the plan’s fiatPaymentProvider metadata ('stripe' or 'braintree'). The SDK auto-detects both via resolveScheme() / resolveNetwork().
X402 Version 2 Specification
The Nevermined Payments Library implements X402 v2, which uses:PAYMENT-SIGNATUREheader for access tokens (replaces Authorization)PAYMENT-REQUIREDheader for payment requirements (replaces custom formats)PAYMENT-RESPONSEheader for settlement receipts- Structured payment credentials with cryptographic signatures
Generate X402 Access Tokens
Subscribers generate access tokens to query agents:Generate Tokens via Nevermined App
Users can also generate X402 access tokens through the Nevermined App:- Visit nevermined.app/permissions/agent-permissions
- Select the plan you’ve purchased
- Configure token parameters (agent, expiration, limits)
- Generate and copy the X402 access token
- Use the token in API requests
Generate Card-Delegation Tokens
For fiat plans usingnvm:card-delegation, pass X402TokenOptions with a CardDelegationConfig:
Reusing Existing Delegations
Instead of creating a new delegation on every token request, you can reuse an existing delegation by passing itsdelegationId. This is useful when running multiple agents that should share a single spending budget:
delegationId is provided, the backend verifies that the delegation is active and that the requesting API key has access, then returns its existing token without creating a new delegation.
Specifying a Card
You can target a specific enrolled card usingcardId. The backend will look for an active delegation on that card or create a new one:
Auto-Selection
When neithercardId nor delegationId is specified (and providerPaymentMethodId is omitted), the backend automatically selects the best card and delegation for the requesting API key. It finds cards accessible to the API key, looks for active delegations with remaining budget, and reuses one if available — otherwise creates a new delegation:
CardDelegationConfig Reference
* Required when creating a new delegation. Ignored when reusing an existing one via
delegationId.
Auto Scheme Resolution
UseresolveScheme() to auto-detect the correct scheme from plan metadata:
DelegationAPI
Manage payment methods and delegations for card delegation:Update Payment Method
Restrict a card to specific NVM API Keys so only designated agents can use it:List Delegations
Retrieve all delegations for the authenticated user:DelegationListResponse Fields
listDelegations() resolves to a DelegationListResponse object:
DelegationSummary Fields
Each item in thedelegations array is a DelegationSummary:
PaymentMethodSummary Fields
X402 Access Token Structure
The access token is a JWT containing an X402 v2 payment credential:Card-Delegation Token Structure
For fiat plans usingnvm:card-delegation, the token contains a JWT-based delegation authorization:
Token Components
- x402Version: Protocol version (2 for current spec)
- accepted: Payment method specification
- scheme:
nvm:erc4337for crypto ornvm:card-delegationfor fiat - network:
eip155:84532(Base Sepolia) for crypto,stripeorbraintreefor fiat (matches the plan’sfiatPaymentProvidermetadata) - planId: The payment plan being used
- extra: Additional metadata (version, agentId, etc.)
- scheme:
- payload: Payment authorization
- signature (erc4337): Cryptographic proof of payment authorization
- token (card-delegation): Signed JWT encoding the delegation claims
- authorization: Subscriber identity and session keys
- extensions: Optional protocol extensions
Verify X402 Permissions
Agents verify tokens before executing requests:Verification Response
Settle X402 Permissions
After successful execution, burn credits:Settlement Response
HTTP Headers (X402 v2)
PAYMENT-SIGNATURE Header
Subscribers include this header in requests:PAYMENT-REQUIRED Header (402 Response)
Agents return this header when payment is required:scheme and network vary by plan type:
Crypto plan:
PAYMENT-RESPONSE Header (Success)
Agents include this header in successful responses:Complete X402 Flow
Subscriber Side
Agent Side
buildPaymentRequired Helper
Simplifies creating X402PaymentRequired objects:scheme is set to 'nvm:card-delegation', the network is auto-resolved from the plan’s fiatPaymentProvider metadata — either 'stripe' or 'braintree'. Pass network explicitly to override.
Best Practices
- Always Verify Before Execute: Never skip token verification
- Settle After Success: Only burn credits after successful execution
- Use X402 v2 Headers: Prefer
PAYMENT-SIGNATUREover Authorization - Return 402 Properly: Include
PAYMENT-REQUIREDheader with details - Log Transactions: Record settlement transaction hashes
- Handle Errors: Provide clear error messages in 402 responses
- Token Reuse: Subscribers can reuse tokens for multiple requests
- Restrict Cards to API Keys: When running multiple agents, restrict each card to specific NVM API Keys using
allowedApiKeyIdsto prevent unauthorized spending - Reuse Delegations: Pass
delegationIdto reuse existing delegations instead of creating new ones on each request — this avoids delegation sprawl and keeps spending consolidated
Related Documentation
- Querying an Agent - How subscribers use X402 tokens
- Validation of Requests - How agents verify and settle
- MCP Integration - Automatic X402 handling in MCP
- A2A Integration - Automatic X402 handling in A2A
Source References:
src/x402/token.ts(getX402AccessToken)src/x402/delegation-api.ts(DelegationAPI: listPaymentMethods, listDelegations, updatePaymentMethod)src/x402/facilitator-api.ts(verifyPermissions, settlePermissions, buildPaymentRequired)tests/e2e/test_x402_e2e.test.ts(complete X402 flow)