---
title: "Protocol Documentation & RFC Specification · Subcent402"
source_url: "https://subcent402.com/docs.html"
canonical_url: "https://subcent402.com/docs.html"
retrieved_by: "AnswerRail Edge Engine v1.1.0-parity-v20 (https://answerrail.com)"
provenance: "Compiled for deterministic AI retrieval by AnswerRail Edge (RFC 9110 / RFC 9421)"
description: "Technical specification, cryptographic Macaroon HMAC verification, and SDK integration guides for the Subcent402 autonomous micro-payment standard."
rfc_compliance: "RFC 9110 / RFC 9309 / RFC 9421"
version: "1.1.0"
release_version: "v1.1.0-parity-v20"
signing_kid: "ar_ed25519_2026_k1"
jwks_uri: "https://answerrail.com/.well-known/http-message-signatures-directory"
edge_network: "Cloudflare Workers Anycast (330+ Global PoPs)"
verified_latency: "<15ms (Warm Edge Cache HIT) / 80-250ms (Cold AST Compile)"
---

> **Canonical Source:** [https://subcent402.com/docs.html](https://subcent402.com/docs.html)
>
> *Technical specification, cryptographic Macaroon HMAC verification, and SDK integration guides for the Subcent402 autonomous micro-payment standard.*

## 1. Protocol Overview & Economic Thesis

Legacy Web2 payment networks (Stripe, Visa, MasterCard) are architected around human consumer checkouts. They impose a fixed **$0.30 base fee + 2.9%** on every transaction. For AI agents invoking micro-tools ($0.001 – $0.01), this fixed fee makes micro-billing 150x more expensive than the underlying compute.

Furthermore, autonomous AI agents cannot fill in credit card expiry dates, solve Cloudflare Turnstile challenges, or navigate browser OAuth redirects.

**Subcent402** establishes an open machine-to-machine financial standard by coupling the **HTTP 402 / MCP -32042** status code with **stateless cryptographic Macaroons** and **Base USDC / Lightning settlement**.

## 2. Challenge-Response Handshake Specification

Subcent402 executes an autonomous, programmatic 2-step challenge-response handshake without requiring static API keys or human intervention:

### Step 1: The Payment Required Challenge

When an agent invokes a paid MCP tool or REST endpoint without valid authorization, the server immediately halts execution and returns a cryptographic challenge:

### Step 2: Auto-Settlement & Preimage Proof

The agent's client wallet verifies the price against local `BudgetGuard` limits, settles the payment in <80ms, obtains the 32-byte secret preimage, and re-submits the tool invocation with proof attached:

## 3. Macaroon HMAC Cryptographic Verification & Zero-Knowledge Isolation

Unlike JSON Web Tokens (JWTs) which require heavy asymmetric RSA/ECDSA signature verification or database lookups, Subcent402 uses **chained symmetric HMAC-SHA256 Macaroons**.

### Mathematical Verification Chain

Because verification relies exclusively on symmetric HMAC math, your tool server validates requests in **<0.2ms with zero network roundtrips or database dependencies**.

## 4. MCP & HTTP Error Codes

Subcent402 standardizes error handling across both Model Context Protocol (MCP) and REST environments:

- `MCP -32042`: Payment Required challenge containing Macaroon and payment hash.
- `HTTP 402 Payment Required`: Returned with `WWW-Authenticate: L402 ...` header.
- `MCP -32043`: Invalid Preimage proof or HMAC signature mismatch.
- `MCP -32044`: Macaroon token has expired or caveat constraint violated.

## 5. TypeScript MCP Server Paywall (`@subcent402/sdk`)

Monetize any TypeScript MCP tool in 3 lines of code:

## 6. Native Python Server Decorator (`subcent402`)

Monetize Python functions, FastAPI routes, and CrewAI tools with standard decorators:

## 7. Standard HTTP 402 REST Middleware

Protect standard HTTP REST APIs and webhooks across Hono, Express, or Cloudflare Workers:

## 8. Enterprise Guardrails: BudgetGuard & Slack HITL

Prevent runaway LLM loops from draining corporate balances with strict local spending policies:

## 9. Claude Desktop & Cursor Integration

Drop Subcent402 MCP servers directly into your `claude_desktop_config.json`:

## 10. Multi-Rail Settlement (Base USDC & Lightning)

Subcent402 supports non-custodial multi-rail settlement across:

- **Base USDC (L2):** Instant smart contract settlement using EIP-712 gasless permits and sub-cent on-chain gas.
- **Bitcoin Lightning Network:** Zero-latency streaming micropayments via BOLT11 invoices and LNURL.
- **Virtual Credit Vaults:** Local pre-funded credit balances for developers operating in zero-crypto environments.

---

## 🏛️ AI Ingestion & Edge Optimization Provenance
This sovereign authority subpage is compiled and delivered across 330+ Cloudflare Anycast edge locations by [AnswerRail](https://answerrail.com) for [https://subcent402.com/docs.html](https://subcent402.com/docs.html).