How agents pay

MeshGateway merchants speak the Machine Payments Protocol (MPP): the open standard for machine-to-machine payments layered on the reserved HTTP status code 402 Payment Required. It is compatible with x402 clients.

The flow

1. An agent requests a paid endpoint, e.g. GET /m/acme/v1/quote.
2. The gateway answers 402 Payment Required with a signed challenge in the WWW-Authenticate header (and an x402-compatible payment-required header).
3. The agent signs an EIP-3009 USDC authorization for the exact amount, made out to the merchant's wallet, and retries with an Authorization header.
4. The gateway verifies and settles on-chain, then fulfills the request with a Payment-Receipt header attached.

On the wire:

1. GET /m/acme/v1/quote
2. ← 402 Payment Required
     WWW-Authenticate: Payment id="…", method="evm", intent="charge"
3. GET /m/acme/v1/quote
     Authorization: Payment <signed EIP-3009 authorization>
4. ← 200 OK
     Payment-Receipt: <signed receipt>

The challenge names the price, currency contract, network, and recipient. The buyer signs a transfer authorization for the exact amount, made out to the merchant's wallet, and retries. The gateway verifies the signature, settles on-chain, fulfills the request, and attaches a signed receipt. No account, no key, no session.

Architecture

MeshGateway is a reverse proxy with a payment layer. Three components do the work:

• The challenger issues signed, replay-proof payment challenges.
• The verifier checks authorizations against the challenge and submits them on-chain.
• The proxy forwards the request upstream only after settlement is confirmed, and never leaks the upstream origin or credentials to the buyer.