We run DeskCrew, a helpdesk where AI agents can use support tools with no account and no API key — they pay per action in USDC over x402, the HTTP-402 payment standard. An agent calls a tool, gets a 402 Payment Required with an exact quote, signs a USDC authorization, retries, done. Five cents, no signup.
Most x402 services use a hosted facilitator to verify and settle payments. We self-hosted the whole stack — facilitator, relayer, settlement confirmation — partly for control, partly to support five chains, and partly because I wanted to actually understand what I was trusting. Here's what bit us on the way, so it doesn't bite you.
x402 in sixty seconds
Client calls your paid endpoint with no payment → you respond 402 with a quote: price in atomic USDC, your receiving address, network, a timeout.
Client signs an EIP-3009 transferWithAuthorization — a gasless, off-chain signature authorizing a USDC transfer from their wallet to yours, bound to a unique nonce.
