x402 vs API keys
An API key usually says which account is calling. x402 can instead expose a per-resource payment requirement, allowing a machine buyer to inspect price and payment terms before it authorizes spend.
Current SML x402 examples are Base/USDC and challenge-driven. Old XRPL/GitHub examples are retired from current authority.
HTTP 402 guide → · Current stack →
The practical difference
| API key | x402 | |
|---|---|---|
| Getting access | Sign up and wait for a key | Call the endpoint |
| Who pays | The account owner, later | The caller, per request |
| If the secret leaks | Anyone can run up the bill | No standing credential to steal |
| Fit for agents | Needs a human to sign up first | Works with any wallet and a spending policy |
When API keys still make sense?
Keys are a good fit for long-term customers with steady usage, rate limits tied to a plan, and invoices. x402 fits occasional buyers and autonomous agents that need one answer now. You can offer both on the same API.