Farcaster The x402 Gate
Proof they could pay — and no key on your server.
A priced route answers an unpaid call with 402 and a challenge. The caller
retries with a signed authorization; the gateway checks it and forwards. No outbound
call, no signing key, nothing held. That is the whole gate, and it is the part that
stays free forever.
The exchange
Challenge, sign, forward.
x402 is a challenge/response protocol for stablecoin payment authorizations, now
stewarded by the Linux Foundation's x402 Foundation. A call to a priced route with
no X-PAYMENT header doesn't fail — it gets told the price.
Unpaid call
402 Payment Required X-Payment-Required: x402 scheme: exact network: base amount: 0.01 USDC resource: /v1/proxy/{id}
No invocation record is created. An unpaid call never reaches your upstream and never shows up in your numbers.
Retry, with authorization
$ curl localhost:8080/v1/proxy/{id} \ -H "X-PAYMENT: <signed EIP-712 payload>" \ -d '{}' 202 Accepted ← forwarded exactly as an unpriced call would be
The mechanic
Four checks, and not one of them touches a chain.
Verification is local, synchronous and self-contained. It runs inside the gateway process on every call to a priced route — pure signature and parameter checking, with no network call to make and no key to protect.
| The check | What it proves | Needs |
|---|---|---|
| The EIP-712 signature is valid | The authorization came from the account it claims | Nothing. No outbound call, no RPC node, no signing key — which is exactly why this half can be free and self-hosted |
value meets the price |
They authorized enough, not merely something | |
asset, network and to match |
They signed for what you advertised, not a cheaper chain or another payee | |
| It is inside its validity window | The authorization is live, not expired or post-dated |
On failure it's 402 again, with a coarse reason. On success the call is
forwarded exactly as an unpriced call would be — the gate adds a decision, not a
different code path.
The boundary
Verifying is not collecting. We don't pretend otherwise.
A route on a tenant with no facilitator configured stops at the gate. You hold cryptographic proof the caller could pay — no funds have moved. Configure a facilitator and the same route gains one step between verify and forward.
| Gate only | Gate + settlement | |
|---|---|---|
| Verification | Local, synchronous | Local, synchronous — unchanged |
| Money movement | None | The facilitator submits on-chain |
| Replay protection | Best-effort | Authoritative — the nonce is consumed on-chain |
| Receipt | None | A settlement sub-record on the invocation, with the transaction hash |
| On failure | 402, no invocation created |
Invocation ends settlement_failed — the upstream never runs |
Gate-only replay protection is best-effort, and you should know that before you price a route. With no settlement step to authoritatively consume the on-chain nonce, a valid signed payload could in principle be replayed against a gate-only route. That is a documented boundary of gate-only mode rather than a bug — enabling settlement is what closes it.
There is no half-settled state to reconcile. Only a successful settle results in the upstream being called, so "served but never paid" is not a condition your books can end up in.
Custody
The gateway never holds a signing key. At any point.
Submitting a transaction requires a party willing to hold a gas key. Farcaster delegates that one step to a facilitator instead of taking it on — and the facilitator is something you can run yourself, under the same Apache-2.0 license as the gateway.
| Capability | Tier |
|---|---|
| The x402 payment gate — verify an authorization before forwarding | OSS |
| Raw payment capture, readable over the API | OSS |
Self-hosting a facilitator — the /settle server |
OSS |
| Settlement and collection, fee modes, a managed facilitator | Commercial |
That third row is the one people miss. You can self-host the whole path — gateway and facilitator both — and collect on-chain without us. The commercial product is not permission to take money; it's not having to run the thing that holds the key.
Next
That's all five. It's one binary.
Catalog, routing, MCP, observability and the gate are not five services to assemble — they're one Go process you can run on your own hardware and read the source of.