---
title: "Prepare an x402 payment from a 402 challenge"
method: POST
path: "/v1/agents/{agent_id}/pay/prepare"
tags: ["Pay"]
---

# Prepare an x402 payment from a 402 challenge

`POST /v1/agents/{agent_id}/pay/prepare`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/agents/{agent_id}/pay/prepare`
- Auth: HTTP bearer

Send the exact bytes the paywall served. The vault parses them, pins the amount that will actually be signed (not the `maxAmountRequired` ceiling), computes the digest a person will authorize, and stores the preimage so the authorize page renders from what the vault saw rather than what the caller claims. `authorization` in the response says what the payment needs next: `allow`, `require_passkey`, `require_grant`, or `deny: <reason>`.

## Path parameters

- `agent_id` string, uuid, required

## Request body

- PayPrepareRequest
  - `challenge_b64` string, required: The exact bytes the paywall served, base64. Sent verbatim rather than parsed by the caller: the digest a person authorizes is computed from this preimage, so anything reinterpreted first would fall outside the binding.
  - `method` string, required
  - `resource_url` string, uri, required
  - `idempotency_key` string: Reused by a caller retrying after a crash so one 402 cannot become two payments. Generated server-side when absent.
  - `mode` 'strict' | 'session' | 'auto': A request, not an instruction — the vault decides.

## Response `200`

Session created; digest and quote returned

- PayPrepareResponse
  - `session_id` string, uuid
  - `payment_digest` string
  - `sign_idempotency_key` string
  - `quote` object
  - `valid_before` string, date-time, nullable
  - `expires_at` string, date-time
  - `authorization` string: allow | require_passkey | require_grant | deny: <reason>
  - `short_window` boolean: The paywall's window is under 30 seconds and may expire while a person is reading the authorize page.

## Other responses

- `400`: Not a usable 402 challenge, or a non-USDC asset
- `403`: pay is not enabled for this agent

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)