# Calling ActionLayer as an AI agent > ActionLayer runs real-world web tasks end to end: an agent submits a natural-language task plus the end user's email, then polls until it finishes. Flat price per task. Purchases made inside a task are paid by the end user from their own connected wallet with their explicit approval - the per-task fee covers the service only. ZeroClick is a paid, transparent proxy in front of ActionLayer's API. Send the same method, path, query, and body you would send the upstream API to `https://agents.actionlayer.io/zcj/cehx0n95vbyl`; ZeroClick collects payment, verifies your identity from the signed payment, and proxies the request upstream. Payment methods today are x402 (Base USDC) and MPP (Tempo USDC), plus credit/debit cards - $0.50+ pay-as-you-go calls. No signup, no API key: you authenticate by signing payment challenges, autonomously or with your human's approval. ## Key URLs - Base URL (call through): `https://agents.actionlayer.io/zcj/cehx0n95vbyl` - Services and pricing: https://agents.actionlayer.io/zcj/cehx0n95vbyl/services - one readable page per service with its price matrix. - Machine catalog: https://agents.actionlayer.io/zcj/cehx0n95vbyl/manifest.json - the same services, meters, plans, and prices as live JSON. Read it at call time; do not cache prices. - API reference: https://api.actionlayer.io/zeroclick/openapi.json - the upstream's own OpenAPI lists the operations, paths, and request/response schemas. Call those paths through the base URL. ## Quickstart For pay-as-you-go calls ZeroClick operates in paid mode: a request through the proxy returns a priced `402 payment_required` you settle per call. There is no separate identity step for a per-call payment - the signed payment itself proves wallet control. 1. Call `https://agents.actionlayer.io/zcj/cehx0n95vbyl/` with your normal request. 2. You receive a single priced `402 payment_required` with a `payment` block (the exact `amountUsd`) and a challenge for each protocol (x402 and MPP). Settle it with your wallet. 3. Retry the same request with the signed payment attached. ZeroClick verifies it, binds your wallet identity from the payment, and proxies your request upstream, returning the upstream's response. That is one 402 total, so stock single-payment x402/MPP clients work unmodified. ## No payment method yet? Get set up with Zero Everything here assumes you can sign the payment challenges, which needs an EVM wallet. If you do not have one, Zero can set you up: it creates an agent wallet and its CLI settles these 402 challenges for you, with no signup or email. Creating the wallet is free and spends nothing. ``` npm i -g @zeroxyz/cli zero auth agent register # anonymous agent account + wallet zero fetch https://agents.actionlayer.io/zcj/cehx0n95vbyl/ # calls through, paying the 402 for you ``` The wallet is yours, stored in `~/.zero/config.json`, and it settles priced calls. It is a payment method, not an identity: plans are gated on a registered agent credential, and free included usage further requires that credential to be claimed by your human with a verified email - register at this host's `/auth.md` to start (one free API call, reusable across every storefront on this network; the claim recipe is on the same page). Full wallet setup: https://zero.xyz/install.md. ## Hand off to a human When the thing your human needs to do is pay, reach for the hosted card checkout first: obtain the URL with `"checkout": true` (the 402's `card` block) and deliver that URL. Hand-offs are not only for declining to transact. Use one whenever your human touches ActionLayer through you: a purchase needs their approval, they want to browse or sign up themselves, or you are citing any ActionLayer page in your final report. In every case do not abandon the task or paste a raw seller URL. This host serves `GET /outclick`, a tracked hand-off: opening it records the referral and answers `302` to a page on ActionLayer's own site, tagged so the seller knows an agent sent the visitor. End to end: 1. Choose the target page for your human - good targets: https://actionlayer.io/. Any http(s) URL on the seller's configured domains is accepted; anything else is rejected with a `400` and no redirect. 2. Build the link with the target URL-encoded in `url`, and append your `agt_` id as `agent` if you hold an agent identity (optional, best-effort attribution - an unknown value still redirects): `https://agents.actionlayer.io/zcj/cehx0n95vbyl/outclick?url=https%3A%2F%2Factionlayer.io%2F&agent=agt_your_agent_id` 3. Deliver the link to your human - in chat or your final report - and let them open it. Every open records a hand-off, so do not fetch it yourself to test - a self-open files a false referral and misattributes your task. The link is guaranteed to 302 to the target; it needs no verification. 4. Your human lands on the target decorated with referral UTM params. The `utm_content` value is unique to this hand-off, so the seller can trace the visit back to it: `https://actionlayer.io/?utm_source=zeroclick.ai&utm_medium=agent_referral&utm_content=ocl_...` A bare `https://agents.actionlayer.io/zcj/cehx0n95vbyl/outclick` (no `url`) is a valid hand-off too: it records the referral and forwards to https://actionlayer.io/. Rule of thumb: every ActionLayer URL that appears in your final message to your human should be an `/outclick` link. Raw seller URLs are for your own fetching, not for handing over. ## Authentication: sign challenges, not API keys Your wallet is your identity. Every challenge and payment travels in standard protocol headers; there are no bespoke auth headers to construct: - x402 (Base USDC): the challenge arrives in the `payment-required` response header (and the `protocols.x402` body block). Sign it and send the payload in the `x-payment` request header. - MPP (Tempo USDC): the challenge arrives in the `www-authenticate` response header (and the `protocols.mpp` body block). Sign a credential for it and send it in `Authorization` under the `Payment` scheme: `Authorization: Payment `. Serialized credentials already carry the `Payment ` prefix. The challenge you sign embeds ZeroClick's payment metadata (the `payment.id` and `zcRequestId` you see in the 402 body), so the signed proof is all a retry needs - no other headers. Do not send the upstream's own credentials. You do not have an upstream API key and do not need one: ZeroClick authenticates to the upstream for you by signing each request. Ignore any `Authorization`, `x-api-key`, or similar auth the upstream's docs require, and omit those headers. ## Identity is a credential, not a wallet Paying a priced 402 needs no identity: an anonymous wallet payment is served. Identity is a registered credential, never a wallet, and it is required for anything ZeroClick will not charge you for (buying or extending a plan). Those requests answer `401 { "error": "bearer_required" }` with a recipe pointing at `/auth.md`: register once, exchange the assertion for a token, and retry with `Authorization: Bearer `. Signing a wallet proves you can pay; it never proves who you are. ## The 402 payment challenge When payment is required you receive a JSON body like: ```json { "error": "payment_required", "zcAgentId": "agt_...", "zcRequestId": "zcreq_...", "plan": { "id": "pln_...", "slug": "...", "billingMode": "payg" }, "payment": { "id": "apay_...", "amountUsd": "1.250000", "rail": "base_usdc", "network": "base" }, "protocols": { "x402": { "x402Version": 2, "network": "eip155:8453", "scheme": "exact", "amount": "1250000", "asset": "0x..." } } } ``` The identity challenge offers both protocols; a priced challenge offers the protocol you authenticated with, or both when you have not authenticated (a bare request) - pay with whichever suits your wallet (the MPP block looks like `"mpp": { "challengeId": "...", "method": "tempo", "intent": "charge" }`). The body also carries the standard x402 document (`x402Version`, `resource`, `accepts`) at the top level - the same content as the headers. The full signable challenges arrive as headers: `payment-required` (x402) and `www-authenticate` (MPP). Settle with your wallet: - x402: client libraries handle signing and the retry for you: `@x402/fetch`, `@x402/axios`, or the `x402` package on PyPI. See https://docs.x402.org/getting-started/quickstart-for-buyers - MPP: sign a credential for the challenge. See https://mpp.dev/protocol/credentials Then retry the same request with the proof attached: the signed payload in `x-payment` (x402), or `Authorization: Payment ` (MPP). Every successful paid response includes a receipt header you can log for your spend records: `payment-response` (x402, base64-encoded settle result) or `payment-receipt` (MPP, serialized receipt). Free identity-only responses carry neither. ## Endpoints - `GET https://agents.actionlayer.io/zcj/cehx0n95vbyl/manifest.json`: machine-readable catalog of services, meters, plans and prices (JSON). Purchasable plans carry a `purchase` object (`url`, `amountRequired`, and `minimumUsd` for credit plans); `purchase` is `null` for pay-as-you-go. A price's `includedUnits` is the number of FREE units per period before its `priceUsd` applies. - `GET https://agents.actionlayer.io/zcj/cehx0n95vbyl/agent/entitlements`: what your agent identity already owns at this seller - active plans with period and `remainingCreditUsd`, covering your credential plus (once claimed) every credential your human claimed. Needs only `Authorization: Bearer `; no payment. An empty list means you own nothing here; a 401 means the token needs re-exchanging, never that you lack purchases. Use it after losing local state instead of re-buying. The network-wide view (all sellers at once) is `GET https://api.zeroclick.io/agent/entitlements`. - `ANY /`: any other path is proxied to the upstream API as a paid request (settle its priced 402, then retry). ## Errors Errors are JSON with the code in the top-level `error` field. The cases you must handle to recover: - `bearer_required` (401): this call needs a registered agent credential a wallet cannot supply. Register via https://agents.actionlayer.io/zcj/cehx0n95vbyl/auth.md, then retry with `Authorization: Bearer `. - `settlement_failed`: your signed payment did not settle (`settlementReason` says why, e.g. `insufficient_funds`). Fix your wallet and retry the request from the start for a fresh challenge. - `payment_refunded` / `payment_consumed` / `payment_failed` / `payment_released`: TERMINAL - that payment reference will never become spendable again. Do not retry it; start over with a fresh request and pay its new 402. - `payment_incomplete`: the referenced payment has not finished (for a card, poll the 402's `card.statusUrl` until it reports complete), then retry. - `payment_provider_unavailable` or any `5xx`: transient - retry the same request with backoff. `rate_limit_exceeded`: wait `retry_after` seconds. Any other unlisted `4xx`: fix per the response body, do not replay. The full error reference - every code and how to react - is at https://agents.actionlayer.io/zcj/cehx0n95vbyl/errors.md. ## Billing modes - `payg` (pay as you go): just call. Each call returns one priced 402 with the exact `amountUsd`; pay and retry. No purchase needed. ## Free included units A price in the catalog may carry `includedUnits: N`: the first N units of that meter per billing period are FREE, and `priceUsd` only applies to usage beyond the allowance. On purchased plans the allowance is tracked per plan access and applied automatically. ## Ceiling pricing Some meters are priced as a ceiling: you pay only your actual usage, settled on a reserve-and-pay rail. Full mechanics and the zc-billing header are at https://agents.actionlayer.io/zcj/cehx0n95vbyl/payment.md. ## Example: a pay-as-you-go call, end to end 1. See services and prices (optional): https://agents.actionlayer.io/zcj/cehx0n95vbyl/services 2. Make the call: ```http POST / HTTP/1.1 Host: agents.actionlayer.io { ...your request body... } ``` 3. You receive the priced `402 payment_required` with the `payment` block and the x402 challenge shown above - one 402, no identity handshake first. Sign it (the client libraries linked above do this for you) and retry: ```http POST / HTTP/1.1 Host: agents.actionlayer.io x-payment: { ...your request body... } ``` 4. `200 OK` (or whatever the upstream returns): ZeroClick settled the payment, bound your wallet identity from it, proxied your request upstream, and returned its response. For MPP the same loop applies with `www-authenticate` challenges and `Authorization: Payment ` retries.