Payments

How Agent Gateway enforces paid access using x402 or MPP, and how admins configure verification and settlement controls.

Agent Gateway can enforce payment before forwarding requests to protected resources. Payment behaviour is configured on the surface using either the x402 or the MPP (Machine Payments Protocol) payment protocol, both of which intercept matching requests and demand a verifiable payment receipt before forwarding them upstream.

Payment policy model

Payment is configured at the surface target level as an x402 or MPP policy. The gateway evaluates payment requirements before the protected backend call is forwarded. If payment is required and missing or invalid, the request is rejected with 402 Payment Required.

Configuring payment on a surface

To enforce payment on a surface, add the Payment element from the Palette. The element is listed under the Security & Policy section of the palette and attaches a payment gate to the surface. A Payment Protocol selector on the element lets you choose between x402 and MPP; x402 is the default for a newly added element, and switching between the two protocols preserves each one’s own configuration.

Once added, the gateway evaluates the selected protocol’s payment requirements for requests arriving at that surface before forwarding them to the target.

x402 in Agent Gateway

x402 is an on-chain micropayment protocol for access control.

What x402 enforces

  • Builds machine-readable payment requirements on 402 responses.
  • Validates submitted payment payloads on retry.
  • Applies configurable verification and settlement behavior.
  • Persists transactions for audit and cost tracking.

x402 verification and settlement modes

x402 Paywall fullscreen editor showing the Verification Mode field set to Level 0 - No verification, the Settlement Mode field set to None, and the crypto network payment options section

x402 supports multiple verification levels, selectable from the Verification Mode dropdown in the Payment element fullscreen editor:

OptionWhat it does
Level 0 - No verification (For testing only)Accepts any payment without verification. The dropdown’s default for a newly added Payment element.
Level 1 - Verify cryptographic signatureVerifies a signed payment authorisation off-chain. No on-chain check.
Level 2 - Gateway verifies on-chainThe gateway itself verifies the payment transaction on-chain.
Level 3 - Facilitator via Fabric GatewayDelegates verification to a connected gateway via DIDComm.
Level 4 - Facilitator via external providerDelegates verification to an external HTTP x402 facilitator.

Settlement behaviour is controlled separately via the Settlement Mode dropdown:

OptionWhat it does
NoneSkips settlement. Verification only. The dropdown’s default for a newly added Payment element.
DeferredRecords the payment and settles later in a batch.
ImmediateSettles immediately after verification. Not recommended for high-throughput surfaces.

These modes let operators balance on-chain assurance, settlement latency, and ease of testing.

MPP in Agent Gateway

Machine Payments Protocol (MPP) is a second payment option on the Payment element, alongside x402. Like x402, it issues an HTTP payment challenge and demands a verifiable receipt before forwarding a matching request, but it accepts both card payments (via Stripe) and on-chain crypto payments in the same policy.

MPP crypto verification modes

MPP’s crypto payment methods support four verification postures, selectable from the Crypto Verification Mode dropdown in the Payment element’s MPP editor:

OptionWhat it does
PassthroughAccepts a claimed proof without checking the chain. Development only; a mainnet crypto payment method cannot be saved with this mode.
On-chainVerifies the payment receipt over RPC before accepting it.
SignatureVerifies an offline cryptographic signature (EIP-3009 / Permit2), without an on-chain check.
FullRequires both a valid signature and on-chain confirmation.

Card payments made through Stripe are unaffected by this setting.

Operations and audit

Both protocols produce durable transaction records, shown together in one unified Payments view, used for:

  • Cost attribution.
  • Payment troubleshooting.
  • Compliance and audit evidence.
  • Integration events to external systems.

Track payment outcomes together with surface monitoring and policy decisions to identify rejected requests quickly and explain exactly why access was blocked.

  • x402 payment protocol: HTTP-native payment handshake using payment requirements and retry proofs.
  • MPP payment protocol: Challenge and settlement details for card and on-chain crypto payment methods.
  • Surfaces: Where payment policy is configured on managed agent traffic.
  • OPA policies: How policy decisions combine with payment controls in the request pipeline.