What does each one cost the buyer?#
Not in money. In steps before the first successful call.
| API key | x402 | |
|---|---|---|
| Steps to first call | Sign up, verify, add payment, create key, configure | Sign a payment and retry |
| Time to first call | Minutes to days | One round trip |
| Buyer identity required | Yes | No |
| Works for a buyer with no email | No | Yes |
| Seller knows who the buyer is | Yes | Only a wallet address |
| Recurring relationship | Natural | Requires building one |
| Rate limiting | Per key, easy | Per address or per resource, harder |
| Revenue predictability | Good | Poor |
The key model is not worse. It is optimised for a buyer who is going to be around, where a one-time sign-up cost spread over a year of calls is nothing.
It fails for exactly one buyer, and that buyer is now common: software that found your endpoint in a catalogue thirty seconds ago, wants one call, and has no human available to complete a form.
What do you lose by offering x402?#
Three things worth being clear-eyed about.
You stop knowing your customers. A wallet address is not a company, a contact or a support relationship. You cannot email your users about a deprecation, because you have no email addresses.
Revenue becomes lumpier. Per-call income from anonymous buyers has none of the predictability of a subscription book. For a business that needs to forecast, this is a real cost.
Abuse control changes shape. You cannot revoke a key, because there is no key. You can refuse an address, but addresses are free to create. The protection is that each call is paid for in advance, which makes volumetric abuse self-limiting in a way free tiers never are.
Note
That last point is underrated. The expensive attack on a keyed API is someone extracting a large amount of value from a free tier or a stolen key. With x402 every request is prepaid, so the worst case is that an attacker buys a lot of your product at your price.
What do you gain?#
Access to buyers who were never going to sign up, and a public record of being paid.
The first is the commercial argument and it is simple: a buyer that abandons at the sign-up form is a buyer you had and lost. For agent traffic that abandonment rate is close to total, because the agent cannot complete the form at all.
The second is less obvious and compounds. x402 settlements are public, so your endpoint accumulates a verifiable history of having been paid by distinct buyers. A new buyer evaluating you can see that without asking you, which is a form of credibility that a private subscriber count cannot produce. How agents choose between services covers why that matters for being picked.
Can you have both?#
Yes, and the strongest pattern is to connect them rather than run them in parallel.
Let a payment mint a key. The first call is paid, anonymous and immediate. In return the buyer gets a credential for everything after. No sign-up, no form, and the seller gets an identified ongoing relationship with a buyer who has already demonstrated they will pay.
Roundhouse does exactly this at GET /v0/test/x402: a one cent payment returns a working API key. The cent is not the point; the point is that the buyer crossed from anonymous to known without a human being involved on either side.
When should an API skip x402 entirely?#
A few honest cases.
- Your product is a contract, not a call. Enterprise data with licensing terms, usage restrictions and an account manager is not improved by anonymous per-call purchase.
- Your unit price is high. Above a few dollars, buyers want refunds and disputes, and an on-chain settlement is final by design.
- You are regulated into knowing your customer. If you must identify buyers, an anonymous payment protocol is the wrong tool and no amount of convenience changes that.
- Your calls are not independently priceable. If value comes from a session or a corpus rather than a request, per-request pricing fits badly. Exact against upto covers the variable-cost cases that do fit.
Frequently asked questions#
Is x402 cheaper for the buyer?#
Not inherently. The seller sets the price either way. It is cheaper in friction and in waste: no minimum, no unused subscription, nothing paid for months you did not call. For low or bursty volume it usually wins on total cost; for heavy steady use a committed plan normally does.
Can I rate limit x402 callers?#
Yes, by payer address, by resource or by both. It is weaker than per-key limiting because addresses are cheap to create, and the mitigation is that every request is already paid for.
How do I do refunds?#
By sending a payment back. There is no reversal mechanism; a refund is a new settlement you choose to make, and refunds and failures covers the cases. If refunds are routine in your business, that is a reason to prefer keys and an invoice.
Will offering x402 cannibalise my subscriptions?#
Rarely, because it serves a different buyer. The risk is real if you price per call below your subscription's effective per-call rate, which is a pricing mistake rather than a protocol one.
How much work is it to add?#
A 402 response with your terms, a verification call to a facilitator, and settling. Charge for your API walks through it; for most APIs it is a day rather than a project.
Where to check this yourself#
Look at what endpoints actually charge before setting your own price. /services lists indexed x402 endpoints with their listed prices and observed activity, and /transactions shows settled amounts rather than advertised ones, which is the figure that tells you what buyers are really paying.