How x402 upto works

x402 puts payment into HTTP: a server answers 402 Payment Required with machine-readable terms, and the client retries with a signed payment. Arcloak uses the upto scheme, where the client signs a maximum and the server settles the actual cost afterwards. That fits inference, where nobody knows the length of the answer in advance.

1. Challenge

Your request arrives without payment. Arcloak prices it (see Pricing) and answers 402 with a PAYMENT-REQUIRED header. A real challenge from api.arcloak.net, decoded:

{"x402Version":2,"error":"Payment required","resource":{...},"accepts":[{"scheme":"upto","network":"eip155:5042","amount":"8","asset":"0x3600000000000000000000000000000000000000","payTo":"0x03C09a266c9a7374a579d7960026EdAB57572a68","maxTimeoutSeconds":600,"extra":{"assetTransferMethod":"permit2","facilitatorAddress":"0x616d5300d89d3042Be000A713Bc6399Ace808918"}}]}

amount is the ceiling in 6-decimal USDC units, here 0.000008 USDC. The response body is:

{"error":{"code":"payment_required","message":"sign the upto authorization in PAYMENT-REQUIRED and retry with PAYMENT-SIGNATURE"}}

2. Authorization

Your client signs a Permit2 PermitWitnessTransferFrom for USDC, up to amount, bound to the treasury (payTo) and to the facilitator, and valid for maxTimeoutSeconds. Nothing moves yet. Permit2 can only pull what USDC allows it to, which is why each payer approves Permit2 once.

3. Paid request

The client sends the same request again, with the signature in the PAYMENT-SIGNATURE header. Arcloak has the facilitator verify it, sends the job to a node, and streams the answer back.

4. Settlement

When the answer ends, Arcloak bills the tokens that were delivered and asks the facilitator, x402.arclight.finance run by Arclight, to settle exactly that amount, never more than the ceiling. The last events of the stream carry the result: an x402.payment event with the transaction hash and the amount, then [DONE].

If no node could answer, the authorization is cancelled instead and nothing is charged.

Discovery

The facilitator lists the x402 resources it settles for at https://x402.arclight.finance/discovery/resources. Arcloak's entry is the resource https://api.arcloak.net/v1/chat/completions with the upto scheme, network eip155:5042, USDC as the asset, the treasury as payTo and the Permit2 transfer method. The amount in the listing is the smallest ceiling the endpoint quotes; every real challenge quotes the ceiling of that request, as in step 1.

Why it is safe to sign

• The signature names the token, the maximum, the recipient and the facilitator. It cannot be used for anything else.
• It expires after maxTimeoutSeconds, 600 seconds.
• The spend controls in @x402/fetch make the client refuse terms for any other asset, or above the per-request cap, before your key is used.
• Every settlement is an ordinary USDC transfer you can check on the Arc explorer.