x402 Agent Payments

The same term set appears twice in the body, once under accepts and once under payment_proof.accepted; both copies were identical in the fetched response. The accepted term set, verbatim:

{
  "scheme": "exact",
  "network": "eip155:8453",
  "asset": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
  "amount": "990000",
  "payTo": "0xb753be5Eac5B29c711051DfF91279834e9C9b9AC",
  "maxTimeoutSeconds": 900
}

For the Day Pass product page itself, with the two public agent activations from 2026-10-22, read the x402 Day Pass page.

{
  "version": 2,
  "resources": [
    "https://zambo.dev/api/x402/discovery",
    "https://zambo.dev/api/x402/day-pass",
    "https://zambo.dev/mcp"
  ]
}

Its instructions field states the working rules, including: "The runtime challenge is authoritative and advertises exact USDC on Base (eip155:8453)." It points clients to the official examples at zambo.dev/guides/x402-agent-payments/, states that autonomous payment covers the agent's own Day Pass only, and notes that for human PayPal checkout a person must approve before checkout.

1. Discover. Read https://zambo.dev/.well-known/x402.json or the free discovery resource to learn which resources are paid and where they live.

2. Request without payment. GET https://zambo.dev/api/x402/day-pass, or call the day_pass_activate tool on the MCP endpoint at https://zambo.dev/mcp. Keep the original request, arguments, and session reference together.

3. Read the live challenge. The server answers HTTP 402 with the terms quoted above. Never pay against a copied amount or an old example; terms are read from the response you just received.

4. Check the terms against policy. Compare network, asset, amount, and destination with the wallet balance and the spending policy. A challenge the policy rejects stays unpaid. Zambo requires no human approval for the Day Pass; the agent's own policy is where a human sets the limits that matter.

5. Sign the authorization. Sign the EIP-3009 TransferWithAuthorization named in the challenge: from the payer address, to the quoted payTo, value 990000, inside the validAfter and validBefore window, with a fresh nonce.

6. Retry with the proof attached. POST the same call to https://zambo.dev/api/x402/day-pass with the base64 JSON envelope in the PAYMENT-SIGNATURE header (X-Payment is also accepted). A refused signature can be retried with a fresh authorization; a consumed nonce or a prior signature is never reused, and an expired challenge is replaced by requesting a new one.

7. Settle, activate, and file the records. The server verifies settlement before activating anything. Success returns receipt_url, run_id, uuid, access_key, expires_at, x402_spend_receipt, and settlement_tx_hash. Keep the access key in memory or a secret store, never in a URL or a public log, and resume the job with it in the X-Zambo-Key header (MCP clients that cannot set headers can send it as the _zambo_key argument) until the expiry.

The guide lists matching package versions checked on October 4, 2026: @x402/core, @x402/fetch, and @x402/evm at 2.28.0, plus viem for the signer. The endpoint's own payment guidance names the same client family. The setup:

npm install @x402/core@2.28.0 @x402/fetch@2.28.0 @x402/evm@2.28.0 viem

1. Build the signer from a key held in a secret store: privateKeyToAccount from viem/accounts over an EVM_PRIVATE_KEY value you load yourself; the guide's example refuses to run if the key is missing or malformed.
2. Register the exact scheme for Base: create an x402Client, then client.register("eip155:8453", new ExactEvmScheme(signer)).
3. Add a spending policy hook with client.onBeforePaymentCreation that aborts unless the selected requirement is network eip155:8453, asset 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913, and amount 990000.
4. Wrap fetch: wrapFetchWithPayment(fetch, client), then POST to https://zambo.dev/api/x402/day-pass. The wrapped client reads the 402, signs, and retries on its own. An optional JSON body of { "_session_id": jobId } binds the pass to an existing job.
5. Read the outcome with x402HTTPClient.processResponse: proceed only when the payment status is settled and the response is ok, then keep access_key, expires_at, and the spend receipt from the payload.

The guide lists the official PyPI package x402 at 2.25.0, checked on October 4, 2026:

pip install "x402[httpx,evm]==2.25.0"

1. Build the account from a key held in a secret store: Account.from_key(os.environ["EVM_PRIVATE_KEY"]).
2. Register the exact scheme: create an x402Client, then register_exact_evm_client(client, EthAccountSigner(account)).
3. Add the same policy check with client.on_before_payment_creation, returning an AbortResult unless the network, asset, and amount match the Day Pass terms above.
4. POST through x402HttpxClient(client) to https://zambo.dev/api/x402/day-pass, with the same optional _session_id binding.
5. Require HTTP 200, then keep access_key, expires_at, and spend_receipt from the JSON result. On any other status, inspect the refusal record instead of retrying blindly: the guide documents refusal receipts with a fixed reason list (malformed payload, wrong amount, wrong asset, wrong network, expired challenge, duplicate payment, policy blocked) and a retryable flag that decides whether a corrected retry is allowed.

None of these renew on their own. When a window ends, the free tier keeps working and the same purchase can be made again the same way.

A completed call. A live Bitcoin price lookup returned BTC at $80,551.00 with its source and time, and its receipt is public: zambo.dev/run/358e91f7-3825-430d-a3f7-4541f28f9050 (HTTP 200 when checked on 2026-10-24).

A call that could not complete. The same lookup with an invalid symbol returned an error (status provider_unavailable: no verified live price exists for that symbol), and it still minted a receipt, marked as an error receipt: zambo.dev/run/05cc10d3-8c7e-4ed9-8f47-e786a6c254ca (HTTP 200 when checked on 2026-10-24).

What a receipt proves is narrow on purpose: the saved result was not changed since it was saved. It never proves the answer was right, and a payment record never proves the work it unlocked was good work. Keeping those claims separate is the point of having both records. Check either receipt, or any other, free at zambo.dev/verify.

What is x402?

x402 is a payment protocol built on the HTTP 402 Payment Required status code. A server answers an unpaid request with a machine readable challenge naming the amount, the asset, the network, and where to pay. The client checks the terms, signs a payment authorization, and retries the same request with the payment attached. On Zambo the quoted asset is USDC and the network is Base (eip155:8453).

What exactly does the live Zambo Day Pass challenge charge?

The live challenge at https://zambo.dev/api/x402/day-pass returns HTTP 402 with x402Version 2 and one accepted term set: scheme exact, network eip155:8453 (Base), asset 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913 (USDC), amount 990000 atomic units ($0.99), payTo 0xb753be5Eac5B29c711051DfF91279834e9C9b9AC, and maxTimeoutSeconds 900. One payment covers 24 hours. It is not priced per call.

How does an agent pay the Day Pass, step by step?

The agent GETs https://zambo.dev/api/x402/day-pass with no payment and reads the 402 challenge. It checks the amount, asset, network, and destination against its own spending policy. It signs the EIP-3009 TransferWithAuthorization named in the challenge and retries as a POST to the same URL with the payment in the PAYMENT-SIGNATURE header (X-Payment is also accepted). The server verifies settlement before activating anything, then returns receipt_url, run_id, uuid, access_key, expires_at, x402_spend_receipt, and settlement_tx_hash.

How does an agent discover Zambo paid resources?

Two public files name them. https://zambo.dev/.well-known/x402.json (version 2) lists three resources: https://zambo.dev/api/x402/discovery, https://zambo.dev/api/x402/day-pass, and https://zambo.dev/mcp, and points to https://zambo.dev/guides/x402-agent-payments/ for official client examples. The discovery resource itself is free and describes the Day Pass terms, including billing_model one payment per 24 hours and per_call false.

What does the receipt prove after an x402 payment?

Two records come out of the flow and they answer different questions. The spend receipt records the payment: the challenged resource, chain, asset, payTo, amount, settlement reference, and activation expiry. The AER-1 receipt for each tool call records the work, and it proves the saved result was not changed since it was saved. It never proves the answer was right. Anyone can check a receipt free at zambo.dev/verify, including receipts for calls that failed or were rejected.

Is the Day Pass or the Zambo Pass a subscription?

No. The Day Pass is one $0.99 payment for 24 hours. The Zambo Pass is $29 for 30 days, one payment, or $290 for 365 days, and $19 for 30 days for $ZAMBO holders. Nothing renews and nothing is charged again automatically. Agents pay USDC on Base via x402; humans pay by PayPal or card through PayPal at https://zambo.dev/day-pass/.

How can AI agents pay for APIs?

Agents pay for APIs when the API speaks a machine readable payment protocol. With x402, the server answers an unpaid request with an HTTP 402 challenge naming the amount, the asset, the network, and where to pay; the agent checks the terms, signs a payment authorization from its wallet, and retries the request with the payment attached. No account, invoice, or human checkout sits in the loop. On Zambo, an agent pays $0.99 in USDC on Base once and gets the Day Pass for 24 hours.

What is x402 for AI agents?

For AI agents, x402 is the way a tool server asks for payment inside the request itself. The server returns HTTP 402 with a machine readable challenge, the agent verifies the amount, asset, network, and destination, pays from its wallet, and retries with the payment attached. Zambo uses x402 for the Day Pass: $0.99 in USDC on Base for 24 hours of access, settled by the agent with no signup form.

How do I let my AI agent buy API access itself?

Give the agent a wallet funded on the network the API charges on, and a spending policy that caps what it may pay without asking you. Then point it at an API that speaks x402: when the server returns a 402 challenge, the agent checks the terms against its policy, pays, and retries the call on its own. On Zambo the agent buys the $0.99 Day Pass in USDC on Base and works for 24 hours, and every payment and call leaves a verifiable receipt you can check later.

Which AI tool platforms accept crypto payments from agents?

Platforms that speak x402 accept crypto payment from agents directly, because the payment rides inside the HTTP request instead of a checkout page. Zambo is one: agents pay USDC on Base for the $0.99 Day Pass and get 24 hours of tool access, with a verifiable receipt for the payment and for every call. x402 indexes such as Agent402 and x402dash list x402-speaking services, and Zambo's Day Pass endpoint is listed on both.