x402 LLM API: Pay-Per-Request for AI Agents
An OpenAI-compatible LLM API that accepts x402 pay-per-request. Your agent gets a 402, signs a payment, and retries. 220+ models, no card on file.
Your agent gets a 402, signs a payment, retries the call, and reads the completion.
TrustedRouter is an OpenAI-compatible LLM API that speaks x402 natively. Most of what you find when you search for x402 AI inference is explainer content about the protocol. This page documents an endpoint that implements it. An unpaid request to the chat completions route returns HTTP 402 with payment terms; the agent signs, retries with the payment attached, and receives a standard completion. The whole flow is plain HTTP.
That is the missing piece for autonomous systems. An agent can buy a single request machine-to-machine with no stored card, no invoice, and no human topping up a balance. Coinbase-led x402 passed roughly 165 million agent transactions and 69,000 active agents by April 2026, and x402 V2 shipped in December 2025. Demand is compounding; very few inference endpoints accept it. Wallet sign-in with MetaMask works without a traditional account, and prepaid credits or BYOK are available when a team wants conventional billing.
# 1. Unpaid request. The gateway answers 402 with payment terms.
curl -i https://api-azure.trustedrouter.com/v1/chat/completions \
-H "Content-Type: application/json" \
-d '{"model":"trustedrouter/auto","messages":[{"role":"user","content":"ping"}]}'
# HTTP/2 402 ...x402 payment requirements in the body
# 2. Sign the terms, retry with the payment attached.
curl https://api-azure.trustedrouter.com/v1/chat/completions \
-H "X-PAYMENT: $SIGNED_PAYMENT" \
-H "Content-Type: application/json" \
-d '{"model":"trustedrouter/auto","messages":[{"role":"user","content":"ping"}]}'
# HTTP/2 200 ...standard OpenAI-compatible completionNo card on file
x402 settles each request as it happens. MetaMask wallet sign-in works without a traditional account. Prepaid Stripe credits and bring-your-own-key cover teams that want a conventional setup. Per-model pricing is transparent and listed at /pricing.
220+ routes, automatic fallback
Claude, GPT, Gemini, DeepSeek V4, Kimi K2.7, GLM-5.2, Qwen 3.5, MiniMax M3 and more across 30+ providers. When a provider goes down, requests roll over automatically. Agents that should not hardcode a model can call trustedrouter/auto, cheap, fast, or synth. The trustedrouter/frontier, trustedrouter/advanced, trustedrouter/professional, and trustedrouter/efficient aliases use fixed ordered fallback pools with no synthesis or implicit privacy floor.
A gateway you can check
The prompt path runs inside a hardware-attested TEE. The source is open, the image digest is published, and the attestation binds to the live TLS session, so it cannot be replayed. TrustedRouter never logs prompt or output content. Ordinary synchronous and streaming inference does not retain it. The opt-in Batch API temporarily retains enclave-encrypted artifacts for up to 30 days. Details at /security.
Machine payments need machine-checkable privacy.
An agent cannot weigh a privacy policy. It can check a signature. Fetch the attestation endpoint with a nonce and you get a JWT signed by the CPU vendor's root key, with an image digest that matches the published artifact. Privacy you can check beats privacy you're promised, and that holds whether the caller is a person or a process.
It holds at volume too: a document-processing company scaled from zero to over a billion tokens per week through the attested gateway within three weeks of onboarding. If your question is human privacy rather than agent plumbing, start with the anonymous LLM API page. For retention terms per route, see security; for measured latency from real routed requests, see the latency benchmarks.
Current routes, prices, privacy, and measured performance.
Catalog facts come from the routes currently configured in TrustedRouter. Performance uses the same cached metadata snapshot as the public leaderboard. Prompts and outputs are not part of these measurements.
| Model | Providers | Context | Input | Output | Privacy | Measured route |
|---|---|---|---|---|---|---|
Anthropic: Claude Opus 4.8anthropic/claude-opus-4.8 |
|
1,000,000 | $5.275/1M | $26.375/1M | varies 5 cited scores | No measurements yet |
OpenAI: GPT-5.5openai/gpt-5.5 |
|
1,050,000 | $5.275/1M | $31.65/1M | ZDR 3 cited scores | No measurements yet |
Google: Gemini 3.5 Flashgoogle/gemini-3.5-flash |
|
1,048,576 | $1.5825/1M | $9.495/1M | ZDR | No measurements yet |
MoonshotAI: Kimi K2.7 Codemoonshotai/kimi-k2.7-code |
+11
|
262,144 | $0.692291/1M to $1.31875/1M | $3.4815/1M to $4.82135/1M | ZDR 5 cited scores | No measurements yet |
Z.ai: GLM 5.2z-ai/glm-5.2 |
+28
|
1,048,576 | $0.3587/1M to $2.370374/1M | $1.5825/1M to $6.838973/1M | Confidential + ZDR 4 cited scores | No measurements yet |
MiniMax: MiniMax M3minimax/minimax-m3 |
+13
|
1,048,576 | $0.24265/1M to $0.633/1M | $1.0128/1M to $2.532/1M | ZDR 4 cited scores | No measurements yet |
Browse every modelReview provider policiesOpen the full leaderboardSnapshot 2026-10-22T19:44:43Z
Questions
What is an x402 LLM API?
x402 is an HTTP payment flow led by Coinbase: a server answers an unpaid request with 402 Payment Required plus payment terms, the client signs a payment, and retries. An x402 LLM API applies that flow to inference. TrustedRouter's OpenAI-compatible endpoint returns a 402 with terms, accepts the signed payment on retry, and serves the completion, so an agent can pay per request without a stored card or a traditional account.
Can an AI agent use the API without an account or credit card?
Yes. x402 pay-per-request settles each call machine-to-machine, and Continue with MetaMask wallet sign-in works without a traditional account. Teams that prefer conventional billing can use prepaid credits through Stripe or bring their own provider keys. We do not promise anonymity; what we publish is a verifiable gateway whose attestation you can check on every session.
Which models can an agent pay for with x402?
The same catalog as every other payment method: 220+ model routes across 30+ providers, including Claude, GPT, Gemini, DeepSeek V4, Kimi K2.7, GLM-5.2, Qwen 3.5, MiniMax M3, Llama, and Mistral. Meta-routes help agents that should not hardcode a model: trustedrouter/auto picks the best fit per request, trustedrouter/cheap picks the cheapest capable route, and trustedrouter/fast optimizes for latency. trustedrouter/frontier, trustedrouter/advanced, trustedrouter/professional, and trustedrouter/efficient use fixed ordered pools: the first member is preferred and the rest are fallbacks, with no synthesis or implicit privacy floor. Per-model pricing is listed at /pricing.
Is my agent's prompt private when it pays per request?
The prompt path runs inside a hardware-attested confidential-compute gateway. TrustedRouter never logs prompt or output content. Ordinary synchronous and streaming inference does not retain it. The opt-in Batch API temporarily retains enclave-encrypted artifacts for up to 30 days. You can verify this rather than take it on trust: the attestation endpoint returns a JWT signed by the CPU vendor's root key, bound to the live TLS session, with an image digest matching the published open-source build. Routes also carry privacy tiers: Open, Zero-Data-Retention, or end-to-end TEE.