Entity · DiggingBeagle record
x402 open payment protocol
Open HTTP 402 payment flow used by autonomous software purchasing APIs, with client-side signing and facilitator-side verification.
Record description
x402 is a payment protocol connecting HTTP 402 requirements to client wallet signatures and facilitator verification. Its relevant roles are the merchant defining requested consideration, the signer authorizing a transfer or login, and the facilitator determining whether a payment settles. V12’s October 2026 review documented three distinct failures across those boundaries and 25 findings overall. Their fixes came before public disclosure; exact SDK language, runtime, token program and extension version determine exposure. A single-payment cap limits one request but cannot establish user-approved purpose, recipient policy or lifetime budget, and a valid token approval must not be mistaken for settled payment.
An x402 exchange cannot be assessed by checking a signature alone. HTTP payment requirements originate with the resource server, signers approve a proposed economic effect, and facilitators evaluate the transaction proof. The client-spending flaw, cross-origin login flaw and Solana verification flaw demonstrate why these are distinct boundaries. The documented patched defaults are not a blanket guarantee of lifetime spending limits or safe integration with every third-party wallet. V12 research.