How it works - Tentacle Pay

Tentacle Pay is three pieces that fit together: a wallet agents control, an x402 rail for charging over HTTP, and a cross-chain layer that lets a Sui balance pay services on other chains. This page explains how they connect.

The problem

An autonomous agent that hits a paid API stalls at the paywall — it has no card, no checkout, and no human to approve the charge:

$ curl https://api.weather.ai/forecast
HTTP/1.1 402 Payment Required
{ "error": "payment_required", "accepts": [{ "amount": "10000", "token": "USDC" }] }

x402 turns that 402 Payment Required status code into a real payment handshake. The agent reads the price, signs a payment, and retries — and the request clears. Tentacle Pay runs that handshake on Sui, where stablecoins settle gasless and in under a second.

Core concepts

x402

An open standard built on HTTP 402 Payment Required. A server states its price; a client signs a payment; a facilitator verifies and settles it on-chain.

Facilitator

A hosted service that verifies signed payments and submits them to Sui. It sponsors gas and never custodies funds — settlement goes straight to the seller.

Gasless settlement

On Sui, stablecoin transfers need no gas token. The facilitator sponsors gas for every supported coin, so agents hold only stablecoins.

dWallet

A distributed wallet powered by Ika 2PC-MPC. It signs payments for other chains using a threshold signature — no single party holds the key.

Roles

Agent (buyer) — a client, script, or AI agent that pays for resources. It wraps its HTTP client with the x402 SDK and signs payments with a Sui wallet.
Seller — an API, MCP server, or agent that charges for a resource. It runs x402 middleware and points it at the Tentacle Pay facilitator.
Facilitator — the Tentacle Pay service at facilitator.tentaclepay.com. It verifies payment payloads, sponsors gas, and settles on Sui.

The x402 flow

Agent requests a resource

The agent makes a normal HTTP request to the seller’s endpoint.

Server responds with 402

If payment is required, the server returns 402 Payment Required with an accepts list describing the price, network, token, and recipient.

Agent signs a payment

The agent picks an option it supports, signs a Sui transaction authorizing the transfer, and retries the request with the signed payload attached.

Server verifies with the facilitator

The server forwards the payload to the facilitator’s /verify endpoint, which checks the signature, amount, recipient, and network.

Server settles and returns the resource

On success the server calls /settle. The facilitator submits the transaction to Sui, waits for finality, and returns the transaction digest in the response headers alongside the resource.

The agent never manages gas, nonces, or RPC calls — the SDK builds the transaction and the facilitator pays for execution.

Settling across chains

Some services live on other chains. Rather than make an agent fund a wallet per chain, Tentacle Pay lets it keep a single Sui wallet and pay outward from there. This uses a dWallet — a distributed wallet whose private key is split across Ika’s 2PC-MPC network, so no single party can sign alone. To pay a service on another chain, the agent:

Pays USDC on Sui

The agent calls the pay_and_sign function in the Tentacle Pay Move package, depositing USDC and asking the dWallet to sign the destination-chain payment.

Gets a verifier attestation

A verifier service signs an attestation bound to this exact call — protocol, signer, amount, message, and an expiry. The on-chain contract rejects the call without it.

The dWallet signs

The Ika coordinator produces a threshold signature over the destination-chain payment authorization, valid on that chain.

The payment settles on the destination

The signed authorization is submitted to the destination chain, paying the service from the dWallet — funded by the USDC the agent just paid on Sui.

The result: one wallet, one balance, any chain. See Cross-Chain for the full architecture.

Where each piece lives

Piece	What it is	Repository
Wallet (`tpay`)	The agent’s CLI wallet and MCP server	`tentaclepay/tpay`
`@tentaclepay/sui-x402`	The x402 SDK for Sui (client, server, facilitator)	`tentaclepay/sui-x402`
Facilitator	The hosted x402 facilitator on Sui	`tentaclepay`
Smart contracts	The Move package for cross-chain `pay_and_sign`	`tentaclepay`

Next steps

Set up the wallet

Install tpay and let your agent pay for an API.

x402 overview

The payment rail in depth — schemes, networks, and the facilitator.

​The problem

​Core concepts