---
title: "Sign a prepared x402 payment"
method: POST
path: "/v1/agents/{agent_id}/pay/sign"
tags: ["Pay"]
---

# Sign a prepared x402 payment

`POST /v1/agents/{agent_id}/pay/sign`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/agents/{agent_id}/pay/sign`
- Auth: HTTP bearer

Evaluates the agent's payment policy, redeems a passkey assertion or consumes a spending grant, then signs. The daily limit is charged at signing time: a payment that is signed and then lost still consumed authority, and only a vault-verified reconciliation returns it. Returns the `X-PAYMENT` header value, never a key.

## Path parameters

- `agent_id` string, uuid, required

## Headers

- `X-Passkey-Token` string

## Request body

- PaySignRequest
  - `session_id` string, uuid, required
  - `mode` 'strict' | 'session' | 'auto'
  - `grant_id` string, uuid: Offer a specific grant; absent means the newest live one.

## Response `200`

Signed; payment header returned

- PaySignResponse
  - `payment_id` string, uuid
  - `payment_header` string: The X-PAYMENT header value. The signature, never the key.
  - `amount_usd` string
  - `pay_to` string
  - `grant_id` string, uuid, nullable

## Other responses

- `403`: Policy refused, or the required authorization was absent
- `409`: ChallengeExpired. Re-fetch the resource for a fresh 402 and prepare again — re-preparing from the stored bytes would reproduce the same expired window.

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)