Anatomy of a 402 challenge

Which fields a client must read: amount, payTo, network, asset contract, skill binding.

Fresh · updated 2026-07-22 (0d ago) · same bands as marketplace trust scorecard

Required mental model

A 402 body is a **machine invoice**, not marketing copy.

maxAmountRequired / amount — atomic USDC (6 decimals)

payTo — treasury address

network / chain id — Base 8453

asset / assetContract — USDC on Base

skill / skill_id — binds payment intent to product

1. Parse JSON (not HTML error pages)

2. Refuse to pay if skill id mismatches the product you intended

3. Log challenge snapshot before broadcast

4. Only then sign the transfer

1. Amounts come from catalog prices, not client input

2. Challenge is GET-safe (no side effects)

3. POST unlock verifies chain facts against the challenge

If clients invent the amount, merchants get underpayment chaos. Challenge fields are law.