Article

Why We Built a Payment Gateway That Speaks Fluent HTTP 402

There's a status code that's been sitting in the HTTP spec since 1997, completely unused by basically the entire internet: 402 Payment Required. We just built a whole business on top of it.

The problem every API builder knows

You build something good. An API, a dataset, a model endpoint — something people actually want to call. And then you hit the same wall everyone hits: how do you charge for it?

Option one: give it away free. Cool until you get hugged to death by someone's cron job hitting your endpoint every 30 seconds forever.

Option two: put it behind a subscription. Now you need billing infrastructure, a pricing page, a sales conversation for anyone who wants more than the free tier, and a customer support queue for people who used 3 calls and got charged for a month.

Option three, the one nobody offers: just let me pay for what I actually use, per call, right now, with no account required.

That's the gap. That's what we built.

Pay-per-call, actually built this time

Our gateway sits in front of any API and speaks x402 — an emerging protocol standard that finally puts that dusty 402 status code to work. Here's the whole flow:

  1. Someone hits your paywalled endpoint
  2. They get back a 402 Payment Required with the exact price, right in the response
  3. They sign a payment for that exact amount
  4. They retry the request with the signed payment attached
  5. They get their data back

One extra round trip. No signup form. No API key request that sits in someone's inbox for three days. No subscription tier that's either too small or absurdly oversized for what they need.

The part that makes this actually usable: gasless payments

Here's the detail that matters most and gets glossed over the least: the caller doesn't need ETH in their wallet.

We're using EIP-3009 (transferWithAuthorization) under the hood, which means the payment is a signed USDC authorization, not a raw on-chain transaction the caller has to gas up for themselves. They sign, we handle settlement. If you've ever tried to onboard someone new to crypto and watched them get stuck on "wait, I need a second token just to move the first token" — this is the fix.

Live. Not a testnet toy.

This is running on Base mainnet, processing real USDC, settling real transactions on-chain right now. Not a demo environment we'll flip to production "soon." Every payment that goes through this gateway is a verifiable, real settlement you can look up on a block explorer. We built it to be trusted with real money because it's handling real money.

Built for more than one API

This isn't a single-purpose tool we hacked together for ourselves. It's multi-tenant from the ground up — any API builder can spin up a paywalled route through a self-serve dashboard: set your price, set your payout wallet, done. We handle payment verification, on-chain settlement, and idempotency protection (so a retried request never double-charges anyone) under the hood. You focus on your API; we handle making people pay for it correctly.

The machine economy needs machine-speed payments

Here's the part we're most excited about: this isn't just built for humans clicking "pay." It's indexed on the x402 Bazaar — a discovery layer where AI agents can find paywalled APIs and pay for them autonomously. No human filling out a signup form, no OAuth flow, no "contact us for API access." An agent that needs your data can find it and pay for it in the same request cycle it would've used to fail against a 401.

If agents are going to be the ones making millions of API calls a day on someone's behalf, they need a payment rail that doesn't assume a human is sitting there with a credit card. That's exactly the rail we built.

Production-grade, not proof-of-concept

We didn't stop at "it works in the happy path." Rate limiting on every paywalled endpoint (including the ones that would otherwise slip past standard middleware — we found and fixed that gap ourselves), full security headers, error monitoring wired in, the whole checklist you'd expect from something people actually put real money through. This is built to run, not built to demo once and quietly break.

Try it

If you're building an API and you're stuck choosing between "free and constantly abused" or "paywalled with so much friction nobody bothers" — that's exactly the problem this solves.

Try it live — pay 1¢, get real data →

Come hit an endpoint, get a 402, pay it, and see your data come back on the retry. It's a genuinely fun thing to watch work for the first time.

← Back to paywall.wickedapi.com