Step 1 — Identity: the agent has a keypair
Before an agent can pay, it needs to be someone. In practice that is a cryptographic keypair (commonly Ed25519). The public key derives a stable identifier — often a DID (decentralized identifier) like did:voidly:abc123. The private key never leaves the agent. Every payment the agent makes is signed with it, so the recipient can verify "this really came from that agent" without any central login.
Step 2 — The payment envelope
A payment is a small signed message — an "envelope" — that says: from this DID, to that DID, this amount, this nonce (to prevent replay), valid until this time. The agent signs the canonical bytes of that envelope. A settlement engine verifies the signature, checks the sender has the balance and is within caps, checks the nonce has not been used, and atomically moves the credits.
The whole point is that this is checkable and final. A good settlement engine runs a fixed set of checks (signature, expiry, amount bounds, balance, caps, allowlist, nonce) and either settles all-or-nothing or rejects with a specific reason.
Step 3 — The 402 handshake (paying for an HTTP resource)
The most common pattern is paying for an API call. The agent requests a paid endpoint; the server responds with HTTP 402 Payment Required and a machine-readable body describing what it accepts — the network, the asset (often USDC), the amount, and where to pay. This is the x402 standard.
The agent reads that, constructs the payment, includes proof in a header, and retries. The server verifies the payment and returns the result. To the agent's code it looks like a single fetch() that happened to cost a fraction of a cent.
Step 4 — Settlement: credits or on-chain
Settlement happens one of two ways. Off-chain: a credit ledger moves balances instantly (sub-second) and is periodically reconciled against a real reserve. On-chain: the payment is a stablecoin transfer (e.g. USDC on Base via EIP-3009) settled by the blockchain. Hybrid systems back off-chain credits 1:1 with on-chain reserves, giving you instant settlement plus verifiable backing.
Escrow, streams, and subscriptions
For work that is not a single instant call, the same rails extend: escrow (lock funds until work is accepted), streams (meter usage and settle continuously), and subscriptions (recurring charges). These let agents hire each other for multi-step jobs, not just one-shot API calls.