Discover.
Negotiate. Save.

BODY='{"city":"Madrid"}'
IDEMPOTENCY_KEY="gate-$(cat /proc/sys/kernel/random/uuid)"

curl --silent --show-error --dump-header gate.headers \
  --output gate-quote.json \
  --request POST https://the402machine.com/api/gate/intents \
  --header "Authorization: Bearer $GATE_PROJECT_KEY" \
  --header "Idempotency-Key: $IDEMPOTENCY_KEY" \
  --header 'X-Gate-Project: gate_project_…' \
  --header 'X-Gate-Route: weather' \
  --header 'X-Gate-Method: POST' \
  --header 'X-Gate-Path: /v1/weather' \
  --header 'Content-Type: application/json' \
  --data-binary "$BODY"

INTENT_ID="$(jq -r .intentId gate-quote.json)"
# After the wallet supplies the 32-byte preimage:
curl --fail-with-body --silent --show-error \
  --request POST "https://the402machine.com/api/gate/intents/$INTENT_ID/prove" \
  --header "Authorization: Bearer ***" \
  --header 'X-Gate-Project: gate_project_…' \
  --header 'Content-Type: application/json' \
  --data "$(jq -cn --arg preimage "$PREIMAGE_HEX" '{preimage:$preimage}')"

The first response is HTTP 402. Payment goes to the project's stored Lightning Address. Do not send a recipient address from the client. For LUD-21 projects, poll GET /api/gate/intents/{intentId} with the same project capability instead of submitting a payer preimage.

Credit rule: quotes, polling, expiry and invalid proofs consume zero credits. Only a persisted AUTHORIZED result consumes one monthly or prepaid authorization.

GATE does not claim x402 compatibility. It uses HTTP 402, payer proof and signed Ed25519 receipts.

BODY='{"planId":"spark"}'
IDEMPOTENCY_KEY="payment-$(cat /proc/sys/kernel/random/uuid)"

umask 077
curl --silent --show-error --dump-header payment.headers \
  --output payment-challenge.json \
  --request POST https://the402machine.com/api/payments/pulse \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $IDEMPOTENCY_KEY" \
  --header 'X-Payment-Protocol: payment' \
  --data-binary "$BODY"

Expected HTTP 402: WWW-Authenticate: Payment plus a small JSON body describing the order, amount, and expiry. Pay the invoice only under an explicit agent spending policy.

Build Authorization: Payment <credential> from the returned challenge and payment preimage. Repeat the same method, URL, Idempotency-Key, protocol header, and byte-identical body. A successful HTTP 200 includes Payment-Receipt and the delivered resource.

umask 077
cat > payment-auth.conf <<'EOF'
header = "Authorization: Payment replace-with-derived-credential"
EOF
chmod 600 payment-auth.conf
set +x

curl --silent --show-error --dump-header payment-result.headers \
  --output capability.json \
  --request POST https://the402machine.com/api/payments/pulse \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $IDEMPOTENCY_KEY" \
  --header 'X-Payment-Protocol: payment' \
  --config payment-auth.conf \
  --data-binary "$BODY"
chmod 600 capability.json

The placeholder credential is inert. The dependency-free repository client writes the invoice to invoice.json and the final delivery to capability.json with mode 0600; it prints only filenames and the non-secret product discriminator. Never pass a live credential as a command-line argument where the process list can expose it.

node <<'NODE'
const fs = require('node:fs');
const result = JSON.parse(fs.readFileSync('capability.json', 'utf8'));
if (!result.settled || !result.resource) process.exit(1);
switch (result.resource.product) {
  case 'catch':
    // ownerToken + ingestToken + publicId
    break;
  case 'whisper':
    // readToken + publicId; the AES key remains client-side
    break;
  case 'pulse':
    // ownerToken + pingToken + publicId
    break;
  default:
    throw new Error('unknown delivered product');
}
NODE

For WHISPER, upload only AES-256-GCM ciphertext. The encryption key never goes to the server and must be combined with the returned read capability locally.