What is allow402?

allow402 is a payment proxy for the x402 protocol — an open HTTP extension that lets any API charge per-call using on-chain micropayments (USDC on Base L2). You create API keys with a credit budget and call any x402-compatible service. The proxy handles EIP-3009 signing, on-chain settlement, and billing automatically.

The x402 protocol

x402 extends standard HTTP: when a client requests a paid resource without payment, the server returns 402 Payment Required with an X-Payment-Requirements header describing what to pay and where. The client signs and retries with a PAYMENT-SIGNATUREheader, then receives 200 OK.

allow402 sits as a transparent intermediary: your app sends a normal request, allow402 intercepts the 402, signs the EIP-3009 USDC authorization from its proxy wallet, and retries — your code only ever sees the 200.

Request flow

The animated diagram below shows the complete lifecycle of a proxied call:

EIP-3009 signing

EIP-3009 defines transferWithAuthorization — a gasless, off-chain-signed USDC transfer. allow402 holds a proxy wallet that signs these authorizations. Your app never manages private keys. The signature is valid for a single transfer to a specific recipient at a specific amount, preventing replay attacks.

Credits & pricing

Unit

1 credit = 1 micro-USDC (10⁻⁶ USDC). All amounts in the API and dashboard are denominated in credits.

Commission

allow402 charges a 5% commission on each proxied call, rounded up, minimum 1 credit.

Service cost:   1,000 credits
Commission:        50 credits  (5%, ceil, min 1)
──────────────────────────────────────────────
Total charged:  1,050 credits

Top-ups

Response cache

allow402 can cache upstream API responses in Redis. When a cached response is available, the call is served instantly — no payment is triggered, so credits are only spent on the first unique request. This makes high-read workloads significantly cheaper and faster.

How to enable

Pass cacheMaxAge (seconds) in the proxy request body. The header X-Cache: HIT or MISS tells you whether the cache was used.

POST /v1/proxy
{
  "url": "https://prices.example.com/BTC",
  "method": "GET",
  "cacheMaxAge": 60   // cache for 60 seconds
}

Cache key

The cache key is derived from the full URL + method + request body hash. Two different users calling the same URL share the same cached response — only the first caller pays.

TTL tradeoffs

Privacy

allow402 operates as a pass-through proxy. Request and response payloads are never stored persistently.