Agentic Payments Made Easy
Payment is the
authentication.
An open standard for API & agentic payments using HTTP 402 and Stripe. No signup. No API keys. No OAuth. Just pay and use — AI agents pay for APIs on their first request, no human in the loop.
import { paymentRequired } from '@stripe402/express'
// One middleware. $0.01 per request.
app.use('/api/weather', paymentRequired({ price: 100 }))Overview
The 402 status code, finally realized.
Reserved since 1997 for 'Payment Required' but never standardized. stripe402 puts it to work — a machine-readable payment protocol between clients and servers, powered by credit cards.
Zero signup
No registration, no API keys, no OAuth. Identity is derived from the card fingerprint via HMAC — same card always produces the same identity.
Credit card rails
Built on Stripe and the payment infrastructure 99% of the internet already uses. No crypto wallets, no stablecoins, no bridging.
Agent-native
Pre-authorize a card and let your AI agent pay for any API on its first request. No human-in-the-loop needed for provisioning.
Protocol
Five steps. Fully automatic.
After the first payment, subsequent requests re-use the client ID until the balance runs out.
Client requests a paid resource
GET /api/weather HTTP/1.1
Server responds 402 with payment details
HTTP/1.1 402 Payment Required payment-required: eyJwcmljZSI6MTAwLCJtaW5Ub3BVcCI6NTAwMDAuLi59
Client tokenizes card via Stripe and retries
GET /api/weather HTTP/1.1 payment: eyJwYXltZW50TWV0aG9kSWQiOiJwbV8uLi4iLCJ0b3BVcCI6NTAwMDB9
Server charges card, returns client ID and balance
HTTP/1.1 200 OK payment-response: eyJjbGllbnRJZCI6ImM4YTJlLi4uIiwiY3JlZGl0c1JlbWFpbmluZyI6NDk5MDB9
Subsequent requests include the client ID
GET /api/weather HTTP/1.1 payment: eyJjbGllbnRJZCI6ImM4YTJlLi4uIn0=
Micropayments
Sub-cent pricing, without the fee problem.
Stripe charges $0.30 + 2.9% per transaction with a $0.50 minimum. stripe402 batches charges into credit top-ups, making per-request pricing at fractions of a cent economically viable.
Credits system
- Unit
- 1/10,000 of a dollar (1 basis point)
- Example
- 100 units = $0.01 per request
- Top-up
- $5.00 = 50,000 units = 500 requests at $0.01
- Storage
- Redis (Lua atomics) or PostgreSQL (WHERE clause)
Client identity
HMAC-SHA256(card_fingerprint, server_secret)- Deterministic — same card on the same server always produces the same ID
- Private — the card fingerprint cannot be recovered from the client ID
- Isolated — different servers produce different IDs for the same card
Comparison
Familiar payment rails, modern protocol.
How stripe402 stacks up against traditional API monetization and crypto-native alternatives.
This project
stripe402
Trade-offs
What you should know.
No protocol is perfect. stripe402 optimizes for low adoption friction at the cost of statefulness.
Strengths
- Uses credit cards — the existing payment rail for 99% of the internet
- Zero adoption barrier for end users
- Self-describing protocol — the 402 response tells clients exactly what to pay and how
- AI agents can pay for APIs autonomously on their first request
- Low regulatory complexity compared to crypto-based alternatives
Limitations
- Stateful — server maintains credit balances (vs. x402's stateless on-chain settlement)
- 3D Secure — EU cards may require interactive authentication, breaking headless flows
- $0.50 minimum charge — top-ups should be $5+ for efficiency
- PCI scope — server-side tokenization requires SAQ-D; browser-based Stripe.js keeps you at SAQ-A
- Single currency — one currency per route (for now)
Packages
Install only what you need.
@stripe402/coreSharedProtocol types, constants, base64 encoding/decoding, HMAC identity derivation, error classes. Zero dependencies.@stripe402/serverServerStripe integration, payment processing, persistence stores for Redis and PostgreSQL.@stripe402/expressServerExpress middleware — add 402 payment gating to any route with a single function call.@stripe402/client-fetchClientFetch wrapper that automatically handles 402 responses, tokenizes the card, and caches the client ID.@stripe402/client-axiosClientAxios interceptor that transparently handles 402 responses.# server npm install @stripe402/express # client (pick one) npm install @stripe402/client-fetch npm install @stripe402/client-axios
Quick start
Running in under a minute.
Server
import express from 'express'
import { paymentRequired } from '@stripe402/express'
const app = express()
app.get('/api/weather',
paymentRequired({ price: 100 }),
(req, res) => res.json({ temp: 72 })
)Client
import { wrapFetch } from '@stripe402/client-fetch'
const paidFetch = wrapFetch(fetch, {
paymentMethodId: 'pm_...'
})
const res = await paidFetch(
'https://api.example.com/weather'
)FAQ