Tutorials, comparisons and design patterns for building autonomous agents that self-fund, call 345+ models and orchestrate MCP Tools.
Between 25 September and 2 October, Cloudflare opened its Monetization Gateway beta and started charging per inference over x402. From Finland, though, the x402 path answers 403 before it ever shows a price. Solana got x402 batch-settlement, including a mode where the seller signs the meter and can take up to the full deposit. A pull request found that the x402 paywall had shipped a May build in every release since, which we confirmed in the published 2.28.0 package. And the MCP Python and TypeScript SDKs fixed OAuth clients that let a server choose where credentials went. In every case, the open question is what the client lets the server decide.
Open Responses is the multi-provider spec built on OpenAI's Responses API, backed by Ollama, vLLM, OpenRouter, Hugging Face and others. We read both releases, the OpenAPI and the 17-test compliance suite, ran it against Ollama 0.30.6, then sent the requests it never sends. Six of the 16 server tests passed, nothing from the April release did, and the server silently ignored allowed_tools, tool_choice, truncation: "disabled" and previous_response_id, answering 200 every time. The spec also has no cache-write tokens, no cost field and no 402, and its WebSocket mode does not fit per-call x402.
Nevermined's nvm:erc4337 scheme puts credits, plans and ERC-4337 session keys behind x402's headers. We read the spec, both SDKs and the contracts, probed the live facilitator, and censused every live plan and every event of the registry, agreement, credit and vault contracts on Base and Tempo, plus a 30-day sandbox sample. The 402 carries no amount, the access token is minted and signed by Nevermined's backend, the default token is a reusable bearer credential, and 372 of 373 live plans keep the credit ledger off-chain: 37 on-chain burns in ten and a half months, the last on 28 April.
AgentKit lets an x402 server cap free access per unique human instead of per wallet, using World ID and an on-chain registry called AgentBook. We read the contract and SDK, censused every registration on World Chain and Base, and ran the published packages locally. The cryptography holds. The humanId is one public pseudonym across every site, registration needs no consent from the agent, the client signs challenges for any origin, and the free-trial counter can be multiplied by respelling the path.
Since May, the x402 exact scheme on Solana has an opt-in second verification path that lets smart wallets pay through a CPI transfer. On Solana that means the wallet's own spending limits run inside the payment, something EVM x402 cannot do. We audited the spec, the TypeScript and Go facilitators, and three live deployments, and found a phantom allowlist entry, an inverted fee ceiling and diverging sponsor policies.
Rhinestone and Biconomy's Smart Sessions is the leading session-key module for ERC-7579 smart accounts. It offers exactly the primitives an x402-paying agent needs. But it was built for the ERC-4337 userOp world, and x402 settlement lives in two places it only half-covers. We read the deployed contracts and audits to find the gaps.
AAuth gives every agent a signing key instead of an API key. Its Budgets extension adds a spending cap that the person's server sizes, the resource enforces, and that moves no money: payment stays on 402 and x402. We read revision -11 (25 September), the unsubmitted Budgets draft and TPX, probed the one named production deployment, and ran the draft's streaming cost trailer through 16 HTTP client setups. Nine never see it, including both OpenAI SDKs. The fallback formula overstates cost, and the default signature does not cover the request body that sets the price.
OpenAI says 'out of money' with a 429, Anthropic with a 400, 402 or 429, OpenRouter with a 402 that sometimes means 'wait'. The four official SDKs honor Retry-After up to anywhere from 60 seconds to 49 days, and x402 has no throttling signal at all. We read the IETF RateLimit draft, the x402 reference code and the SDK retry logic, then probed 1,951 x402 sellers: 8.6% publish a limit, 7 use the current syntax, and some count unpaid price checks against paid quota.