Tutorials, comparisons and design patterns for building autonomous agents that self-fund, call 345+ models and orchestrate MCP Tools.
x402 v2 puts the whole protocol in headers, and its HTTP spec never mentions browsers. In a local harness on the 2.28.0 SDK with headless Chrome, no server middleware set a CORS header, cors() defaults hid the price, and even a correct minimal CORS setup failed because @x402/fetch adds the response-only Access-Control-Expose-Headers to its own paid retry (fix #3478, open since September 15). An unpaid HEAD ran a paid GET handler; the fix #3796 is merged but no SDK has released since September 29. Node fetch fails above 16 KiB of headers and aiohttp above 8,190 bytes per header. A census of 2,233 Bazaar sellers: 875 allow the origin, 635 expose the price, 568 can be paid by a correct browser client, 120 by the shipped one; 126 answer the preflight with 402, 242 serve HEAD without payment, 188 exceed aiohttp's limit. Our own gateway hides its price too. Six steps for LLM4Agents.
Besides its version, the merged x402 offer-receipt extension signs five receipt fields: network, resource URL, payer, issue time and an optional transaction hash. No amount, payee, request or response. In a local harness on the 2.28.0 SDK, the includeTxHash flag never reached the receipt (issue #3824, an aliasing bug with a one-line fix still open in #3826), and two separate payments made in the same second came back with byte-identical receipts, signature included. One hour of Base USDC shows why that matters: 22.4% of 4,176 EIP-3009 settlements had a twin in the same block with the same payer, payee and amount. In the Bazaar, 32 of 2,452 hosts sign offers; all 796 EIP-712 signatures verify, but 21 of 22 EIP-712 signers publish neither a did:web entry nor a _controllers DNS record for their key. We read the five open proposals that try to fix this: receipt v2's salted nonce commitment (recomputed, and linked live on Base Sepolia), svm-memo, delivery-receipt with Ed25519 plus ML-DSA-65 and SSE stream digests (vectors verified, plus the one live key directory), the Buyer Delivery Claim and the Settlement-Receipt Binding. Six steps for LLM4Agents.
Between 9 and 16 October, Chainalysis counted 138 million x402 transactions on Base and found new wallets spending 18 minutes after funding. Our own census of the x402 Bazaar, which now publishes unique payers per endpoint, found 43,338 resources whose median has one payer, with a single endpoint carrying 38% of all calls. Proof put x401 into production, a header-based identity layer that explicitly leaves payment to 402. Shopify's Shop skill brought spend requests to stateless MCP on card rails. And x402 merged a fix for HEAD requests that reached paid GET handlers without payment, which we reproduced on the published 2.28.0 packages, while Coinbase dropped x402 from its bug bounty.
The x402 spec defines settle as the step that establishes finality 'from the resource server's perspective,' and its SettleResponse carries no field for how final a payment is. The exact family rules make client-submitted methods declare a finality event, but not the facilitator-submitted EVM and SVM paths; only the Cardano binding lets the seller choose a confirmation depth. We read what each implementation waits for, from NEAR's FINAL to Starknet's ACCEPTED_ON_L2. Then we ran x402's own EVM signer wrapper against 100 live USDC settlements on Base's public RPC: all resolved as success in a median 179 ms, 94 before their block was sealed, and all 100 held through the safe head. A ten-minute sampler put Base's finalized head about 18 minutes behind the tip and Polygon's about 3 seconds. On Solana, faster slots shrink the documented 60–90 second blockhash window to about 25 seconds, and Alpenglow's October 21 migration opens a vote-only window where no x402 settlement can land. Seven steps for LLM4Agents.
An agent that pays per call pays for a model string, and three things can change what that string means. Anthropic pins every ID; OpenAI pins snapshots behind aliases and keeps one floating name; Google defines stable, preview and latest strings, and on October 8 began routing the stable gemini-3.5-flash and gemini-3.7-flash to 3.6 and 3.8 Flash, which ignore temperature. OpenAI gave GPT-4o and GPT-4.1 three months' notice on October 14, and Gemini 4 Argon and 3.6/3.8 Flash prices double on December 1 and January 1. Downstream catalogs lag: OpenRouter still prices gemini-3.5-flash at $1.50/$9.00, carries no expiration date on any of 23 OpenAI entries with announced shutdowns, and 5 of its 19 latest aliases list prices that differ from their targets; LiteLLM has 27 of 32 OpenAI dates but no field for a dated price. x402 binds a URL, not a model. Our own 402 quotes the rerouted model at 2.4x its successor, still sells two models Anthropic has retired, and still issues a one-cent quote for strings we do not have. Eight steps to fix it, in order.
Refusals now come in three shapes: text the model writes, a classifier decline returned as HTTP 200 (Anthropic's stop_reason refusal with a stop_details category), and a classifier block returned as an error (OpenAI's bio_policy, which OpenRouter surfaces as a 403). Only Anthropic documents refusal billing, and it changed twice in four months: since September 24, 2026 a refusal before any output is billed for bio, frontier_llm and reasoning_extraction, free for cyber, general_harms and null, and a mid-stream refusal always bills what streamed. Fallback credit refunds the retry's cache write, about $0.25 vs $0.02 on a 40,000-token turn moved to Opus 4.8, but the token lives five minutes and only redeems in the workspace that got the refusal. Once a refusal crosses into the Chat Completions shape the category is gone: LiteLLM and the AI SDK map it to content_filter, Anthropic's own compatibility layer leaves message.refusal empty. Under Ollama 0.30.6, 204 policy refusals out of 480 calls all ended with finish_reason stop and none set a refusal field. The x402 reference middlewares settle anything under HTTP 400, so a refusal is a sale unless the seller decides otherwise. Seven steps for a gateway that bills a no at what it cost.
Context length is the one request variable that changes both whether a call can succeed and what it costs, and both changes are steps. Claude Haiku 5.5 reprices the whole request 5x past 100,000 prompt tokens; Gemini 2.5 Pro and 3.1 Pro Preview step up at 200k; the GPT-5.4/5.5 and GPT-6 families charge 2x input and 1.5x output past 272K. Past the window, providers answer in four dialects: Anthropic's 400 'prompt is too long' or a 200 with model_context_window_exceeded, OpenAI's deprecated truncation switch, OpenRouter's canonical error_type that its Responses skin can turn into a successful 'length' completion, and silence. Ollama 0.30.6 returned HTTP 200 and finish_reason stop on every over-window prompt, kept only four head tokens, lost the system message 5 times out of 5 and reported the truncated token count. LiteLLM detects overflow by matching error strings and maps model_context_window_exceeded to 'stop'. Our own 402 is linear across every tier: on GPT-5.5 it goes from 1.32x list at 272,000 tokens to 0.67x at 273,000, and it still quotes requests up to 2.5x past a model's window. Seven steps to fix it, in order.
The Stellar binding of x402 exact is the only one where the buyer never picks the transaction that lands: it signs Soroban authorization entries with a deadline counted in ledgers, and the facilitator assembles everything around them at settle time. We ran real payments on testnet against the reference facilitator at 2.28.0. Ledger close time is a constant 5.000 seconds over 2,000 pubnet ledgers, so the arithmetic is sound, but the height each party reads is not shared. Verify checks that the authorization is not too long-lived and never that it is long-lived enough, so a payload can verify and then fail to settle — it fails closed, costing availability rather than funds. Plus the fee ceiling with 1.50x headroom, the muxed address that passes validation and fails verification, why smart accounts with spending caps cannot pay, a mainnet fee-account census where the median settlement fee lands within 3% of our testnet number, what it means for our gateway and six steps.