---
title: "Pay a payment challenge"
method: POST
path: "/x402/challenges/{id}/pay"
tags: ["Payments"]
---

# Pay a payment challenge

`POST /x402/challenges/{id}/pay`

Settle a challenge addressed to your org as payer. The request body
carries a signed x402 `PaymentPayload`: an EIP-3009
`transferWithAuthorization` signed locally with your own key, whose nonce
is bound to the challenge via the SDK's `deriveEip3009Nonce`. The platform
verifies every signed field against its own record of the challenge,
applies your spend policy, and settles on-chain through a facilitator.
Settlement is non-custodial; Primitive never holds funds. Idempotent:
paying an already-settled challenge returns the original receipt. Most
callers use the SDK `pay()` helper rather than building the payload by
hand.

## Path parameters

- `id` string, uuid, required

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `payment` object, required — A signed x402 v1 `PaymentPayload`. The SDK `pay()` helper builds this; callers rarely construct it by hand. Field names are x402-native.
    - `x402Version` 1, required
    - `scheme` 'exact', required
    - `network` 'base' | 'base-sepolia', required
    - `payload` object, required
      - `signature` string, required — The EIP-712 signature over the authorization.
      - `authorization` object, required — The EIP-3009 `transferWithAuthorization` fields, as strings.
        - `from` string, required
        - `to` string, required
        - `value` string, required
        - `validAfter` string, required
        - `validBefore` string, required
        - `nonce` string, required

## Response `200`

Challenge settled (or already settled)

- object
  - `success` true, required
  - `data` object, required
    - `id` string, uuid, required
    - `status` 'settled', required
    - `settle_tx` string, nullable, required — On-chain settlement transaction hash.

## Other responses

- `400` — Invalid request parameters
- `401` — Invalid or missing API key
- `403` — Authenticated caller lacks permission for the operation
- `404` — Resource not found
- `409` — The request conflicts with the current state of the resource
- `422` — The request was well-formed but could not be processed. For Payments this covers a missing payout address, a failed payment verification, a spend-policy decline, or an expired challenge; `error.code` distinguishes them.
- `429` — Rate limit exceeded
- `502` — Primitive could not complete the downstream SMTP request

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) · [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/primitive/primitive-api/revisions/c2299d28022c/schema)