Module headers 

Available on crate features client or server only.

x402 HTTP header names and Cache-Control helpers.

Request: PAYMENT_SIGNATURE, SIGN_IN_WITH_X (never emit as response). Response: PAYMENT_REQUIRED, PAYMENT_RESPONSE. Facilitator-only: EXTENSION_RESPONSES (not buyer CORS).

Constants

EXTENSION_RESPONSES

Facilitator-only sidechannel. Not a buyer CORS expose/allow header.

PAYMENT_REQUIRED

402 challenge header carrying a base64 PaymentRequired.

PAYMENT_RESPONSE

Settlement receipt header carrying a base64 SettleResponse.

PAYMENT_SIGNATURE

Buyer retry header carrying a base64 PaymentPayload.

SIGN_IN_WITH_X

SIWX proof header (base64 JSON). Never emit as a response header.

X402_ALLOW_HEADERS

CORS Access-Control-Allow-Headers value for the app CorsLayer.

X402_EXPOSED_HEADERS

CORS Access-Control-Expose-Headers value for x402 response headers.

Functions

ensure_expose_headers

Ensures Access-Control-Expose-Headers advertises the x402 response headers.

merge_private

Merges private into Cache-Control (200 + Payment-Response).

set_no_store

Writes Cache-Control: no-store (402 / 412 / settle-fail).