How x402 works

x402 revives the long-dormant 402 Payment Required status code from RFC 7231 and puts a stablecoin payment in front of an HTTP request. Cloven's implementation binds it to USDG settlement on Robinhood Chain and ships it as a first-class auth path alongside API-key + credit-balance flows.

Read this first — what Cloven's x402 actually is

Cloven implements a Cloven-native on-chain-receipt scheme, not a hosted-facilitator integration. Concretely:

• Your client broadcasts its own USDG transfer and pays its own gas.
• Your client passes the settled tx hash in the X-402-Payment header.
• The Cloven server self-verifies the receipt against Robinhood Chain with viem. There is no third party in the settlement path.

What that means in practice:

• There is no hosted facilitator. Cloven does not run one, and does not call one.
• There is no gasless / EIP-3009 settlement path. USDG does expose transferWithAuthorization and permit, so a self-hosted facilitator is a plausible future phase — but it is not shipped and you should not build against it.
• There is no interop with third-party x402 facilitator services, agent kits, or x402-fetch-style clients. They do not support chain 4663. Use @cloven/sdk in wallet mode, or roll your own client against the wire format on the payments page.

The header, status code, and quote/settle shape are x402-flavoured. The settlement is Cloven's own.

Settlement parameters

Why USDG on Robinhood Chain

Agent-to-agent friendly. An autonomous agent with a bare EOA can pay Cloven without a human in the loop. No "log in, paste key, configure dashboard." The agent reads its own ETH balance, signs its own USDG transfer, and pays its own bill.

Fast enough to sit in front of a request. Robinhood Chain blocks land in ~50–100ms. A per-call payment that has to confirm before the API call is only viable at that cadence; on a ~2s-block chain the 402 dance dominates the latency budget.

A regulated, fully-reserved dollar. USDG is Paxos' Global Dollar — the same regulated issuer stack behind their institutional and RWA products. It is 1:1 USD with 6 decimals, so every price in the pricing table is unchanged from the prior rail; only the denomination label moved.

Composable with $CLOVEN (Phase 3). Stake-tier discounts plug in cleanly: the wallet paying via x402 is the same wallet whose $CLOVEN stake determines its tier. Discount math happens at quote time, no separate ledger. The token's launch chain and mechanics are TBD — to be re-spec'd for Robinhood Chain.

Real revenue, real burn. 50% of x402 revenue routes to $CLOVEN buyback-and-burn once Phase 3 lands. Phase 1 accumulates the 50% share in a public reserve wallet. Buyback routing is likewise chain-TBD.

Five-step flow

1.  Agent       →  Cloven    GET /v1/fresh?pack=crypto             (no auth)
 
2.  Cloven      →  Agent     402 Payment Required
                              { payment: { scheme:  "x402",
                                           network: "robinhood",
                                           asset:   "USDG",
                                           amount:  "0.001000",   ← decimal string
                                           recipient: 0xClovenTreasury,
                                           validUntil: <unix sec>,
                                           nonce:   <server uuid> } }
 
3.  Agent       →  RH Chain  USDG.transfer(recipient, amount)      (agent pays ETH gas)
 
4.  Agent       →  Cloven    GET /v1/fresh?pack=crypto
                              X-402-Payment: base64({
                                scheme:  "x402",
                                network: "robinhood",
                                txHash:  0xabc...,
                                payer:   0xWallet... })
 
5.  Cloven      →  Agent     200 OK
                              { state, brief, citations, freshness }

The 402 quote includes a server-generated nonce and a 5-minute validUntil. Cloven verifies the on-chain Transfer event emitted by the USDG contract against payer, recipient and amount. Once verified, the tx hash is cached in Redis for 24 hours under x402:tx:robinhood:<hash> to prevent replay — note the key is scoped by settlement network, so a tx hash from the retired Base rail can never be replayed.

What "verified" means

A payment is accepted iff every condition holds:

1. Tx exists on Robinhood Chain. eth_getTransactionReceipt(txHash) returns a receipt.
2. Tx is confirmed (status === "success").
3. Tx emitted a Transfer(from = payer, to = recipient, value ≥ amount) event from the USDG contract.
4. Recipient matches X402_RECIPIENT_ADDRESS env var (Cloven treasury).
5. Tx confirmed within the last 10 minutes (anti-replay).
6. x402:tx:robinhood:<txHash> key is not already set in Redis (idempotency).

Any failure → a typed error code (tx_not_found, tx_reverted, tx_too_old, insufficient_payment, no_stable_transfer_in_tx, wrong_network). No partial credit, no "we'll honor it next time." The agent must re-quote and pay fresh.

What it is NOT

• Not a subscription protocol. x402 is per-call only. Credit packs handle bulk keyed flows.
• Not multi-chain. USDG on Robinhood Chain only. A payment header declaring any other network is rejected with wrong_network — this is a hard cut, the Base rail is retired.
• Not gasless. The agent's wallet pays ETH gas on Robinhood Chain (fractions of a cent per tx). A self-hosted EIP-3009 facilitator is a possible future phase, not a shipped feature.
• Not facilitator-brokered. No third party sits between your agent and the chain. See the caveat at the top of this page.
• Not paid in $CLOVEN. $CLOVEN is for stake-tier discounts, not as a payment asset. Keeping the token clean of "money grab" framing is deliberate.

What you actually do

If you're writing your own client: see the payments page for the exact wire format. If you're using @cloven/sdk: pass a viem WalletClient to the factory and the entire flow happens transparently — see SDK x402 mode.

On idempotency

The 24-hour idempotency window means: pay once, retry the API call as many times as you like for 24 hours. Useful if the connection drops between Step 4 and Step 5 — replay the call with the same X-402-Payment header and Cloven serves the response without double-charging.

After 24 hours the tx hash purges from the idempotency cache. Re-using it after the purge returns tx_too_old (the on-chain block timestamp is now > 10 min old). At that point, pay fresh.

What gets traced

Every x402-paid call writes a traces row tagged paid_via: "x402", with amount_usd populated from the actual USDG paid. Phase 3 Commons reads these to compute trace-contributor revshare — your agent's wallet earns when its traces sell to AI labs (if the operator opted in).