# 402 challenge variants One row per scheme. Null means the cited page does not state that field. x402 v2 header names, field lists, CAIP-2 identifiers, and the exact and upto schemes are in the wire-facts file: https://agentpaywire.com/api/protocols/x402-v2-wire.json. JSON: https://agentpaywire.com/api/protocols/402-variants.json Disclaimer: https://agentpaywire.com/disclaimer.json ## x402 exact - id: x402-exact - role: payment scheme - source: https://docs.x402.org/core-concepts/http-402 - verified_at: 2026-10-22 - status_code: 402 - source: https://docs.x402.org/core-concepts/http-402 - verified_at: 2026-10-22 - header_names: ["PAYMENT-REQUIRED","PAYMENT-SIGNATURE","PAYMENT-RESPONSE"] - source: https://docs.x402.org/core-concepts/http-402 - verified_at: 2026-10-22 - proof_format: V2 headers are base64-encoded JSON. PAYMENT-REQUIRED carries a PaymentRequired object. PAYMENT-SIGNATURE carries the client PaymentPayload. PAYMENT-RESPONSE carries a SettlementResponse. - source: https://docs.x402.org/core-concepts/http-402 - verified_at: 2026-10-22 - settlement_timing: The exact scheme typically settles immediately, in the same HTTP round trip. The same page says upto typically settles immediately, and batch-settlement confirms the authorization first and redeems onchain later. - source: https://docs.x402.org/core-concepts/http-402 - verified_at: 2026-10-22 - typical_facilitators: null - limits: null - spec_url: https://docs.x402.org/core-concepts/http-402 - source: https://docs.x402.org/core-concepts/http-402 - verified_at: 2026-10-22 ## Mastercard Agent Pay for Machines - id: mastercard-agent-pay-deferred-voucher - role: payment scheme - source: https://www.mastercard.com/global/en/news-and-trends/press/2026/october/Mastercard-Agent-Pay-for-Machines-in-action.html - verified_at: 2026-10-22 - status_code: 402 - source: https://www.mastercard.com/global/en/news-and-trends/press/2026/october/Mastercard-Agent-Pay-for-Machines-in-action.html - verified_at: 2026-10-22 - header_names: null - proof_format: The agent creates a digitally signed payment voucher, described as a promise to pay within its approved limit. The provider verifies the voucher before delivering the service. - source: https://www.mastercard.com/global/en/news-and-trends/press/2026/october/Mastercard-Agent-Pay-for-Machines-in-action.html - verified_at: 2026-10-22 - settlement_timing: The page says to guarantee payment now and settle later. Voucher exchange happens off-chain, and providers can combine vouchers and redeem them later. In the Cloudflare Connect pilot, Base is the on-chain settlement network, Coinbase Developer Platform provides the wallet infrastructure that funds the agent, and BVNK is the agent wallet. - source: https://www.mastercard.com/global/en/news-and-trends/press/2026/october/Mastercard-Agent-Pay-for-Machines-in-action.html - verified_at: 2026-10-22 - typical_facilitators: null - limits: A business gives the agent a job and a spending limit. The page does not publish a numeric cap. - source: https://www.mastercard.com/global/en/news-and-trends/press/2026/october/Mastercard-Agent-Pay-for-Machines-in-action.html - verified_at: 2026-10-22 - spec_url: null ## L402 - id: l402 - role: payment scheme - source: https://docs.lightning.engineering/the-lightning-network/l402/protocol-specification - verified_at: 2026-10-22 - status_code: 402 - source: https://docs.lightning.engineering/the-lightning-network/l402/protocol-specification - verified_at: 2026-10-22 - header_names: ["WWW-Authenticate","Authorization"] - source: https://docs.lightning.engineering/the-lightning-network/l402/protocol-specification - verified_at: 2026-10-22 - proof_format: WWW-Authenticate uses the L402 scheme with a base64 macaroon and a Lightning invoice. The client retries with Authorization: L402, the base64 macaroon, a colon, and the hex-encoded invoice preimage. - source: https://docs.lightning.engineering/the-lightning-network/l402/protocol-specification - verified_at: 2026-10-22 - settlement_timing: The client pays the Lightning invoice from the challenge. Payment reveals the preimage, and the client then presents that preimage with the macaroon. - source: https://docs.lightning.engineering/the-lightning-network/l402/protocol-specification - verified_at: 2026-10-22 - typical_facilitators: null - limits: null - spec_url: https://docs.lightning.engineering/the-lightning-network/l402/protocol-specification - source: https://docs.lightning.engineering/the-lightning-network/l402/protocol-specification - verified_at: 2026-10-22 ## MPP - id: mpp - role: payment scheme - source: https://mpp.dev/protocol/transports/http - verified_at: 2026-10-22 - status_code: 402 - source: https://mpp.dev/protocol/transports/http - verified_at: 2026-10-22 - header_names: ["WWW-Authenticate","Authorization","Payment-Authorization","Payment-Receipt"] - source: https://mpp.dev/protocol/transports/http - verified_at: 2026-10-22 - proof_format: The challenge is WWW-Authenticate: Payment with auth-params. The request and opaque parameters are base64url-encoded JCS JSON. The credential is base64url-encoded and is sent on Authorization, or on Payment-Authorization when the challenge sets that header. Payment-Receipt is base64url-encoded JSON. - source: https://mpp.dev/protocol/transports/http - verified_at: 2026-10-22 - settlement_timing: Stripe's guide shows the server recording the payment with Stripe and then returning the requested resource. - source: https://docs.stripe.com/payments/machine/mpp - verified_at: 2026-10-22 - typical_facilitators: [{"name":"Stripe","url":"https://docs.stripe.com/payments/machine/mpp"}] - source: https://docs.stripe.com/payments/machine/mpp - verified_at: 2026-10-22 - limits: Stripe's guide states a minimum of 0.50 USD for card payments through Shared Payment Tokens and 0.01 USDC for stablecoin payments. It says Tempo transfers use USDC.e. It does not state a maximum. - source: https://docs.stripe.com/payments/machine/mpp - verified_at: 2026-10-22 - spec_url: https://mpp.dev/protocol/transports/http - source: https://mpp.dev/protocol/transports/http - verified_at: 2026-10-22 ## x401 - id: x401 - role: identity companion - source: https://proof.com/x401 - verified_at: 2026-10-22 - status_code: 401 - source: https://proof.com/x401 - verified_at: 2026-10-22 - header_names: ["PROOF-REQUIRED","PROOF-PRESENTATION","PROOF-RESPONSE"] - source: https://proof.com/x401 - verified_at: 2026-10-22 - proof_format: PROOF-REQUIRED is base64url JSON. The canonical example uses scheme x401, version 0.1.0, presentation_protocol openid4vp, and a DCQL query for a jwt_vc_json credential. The agent sends the presentation in PROOF-PRESENTATION. - source: https://proof.com/x401 - verified_at: 2026-10-22 - settlement_timing: null - typical_facilitators: null - limits: null - spec_url: https://proof.com/x401 - source: https://proof.com/x401 - verified_at: 2026-10-22