One 402, every payment dialect.

More than ten agent-payment protocols shipped between October 2025 and April 2026, and a seller has to pick one. polyglot402 is a small Fetch API middleware that answers a request with a single 402 carrying every protocol's challenge at once, settles whichever one the caller actually speaks, and records the result in one receipt format.

See the 402 What it does not do

MIT licensed. The repository stays private until a settlement has actually run on a live network.

The whole idea, in one response

A caller that has never seen your service does not know which protocol you take. Rather than making it guess or read your docs, the first refusal states every option it could use, in each protocol's own vocabulary, in one round trip.

HTTP response, abridged

HTTP/1.1 402 Payment Required
PAYMENT-REQUIRED: eyJ4NDAyVmVyc2lvbiI6MiwiYWNjZXB0cyI6W3sic2NoZW1l…
WWW-Authenticate: L402 macaroon="eyJpZGVudGlmaWVy…", invoice="lnbc10n1p…",
                  Payment id="c_8f3a", realm="example.com", method="tempo",
                  intent="charge", request="eyJhbW91bnQiOiIw…", expires="2026-09-07T02:00:00Z"
Content-Type: application/json

{
  "error": "Payment required",
  "price": { "amount": "0.01", "currency": "USD" },
  "accepts": [
    { "protocol": "x402", "scheme": "exact", "network": "eip155:8453" },
    { "protocol": "l402", "amountMsat": 1000 },
    { "protocol": "mpp",  "method": "tempo" }
  ]
}

One header, many challenges

RFC 9110 allows several challenges in one WWW-Authenticate, so L402 and MPP share it while x402 uses its own header. Nothing is invented; each adapter emits exactly what its specification says.

Routed on the way back

A request carrying a credential is matched to the adapter whose format it fits, verified and settled there, and only then does your handler run.

One receipt shape

Every protocol produces the same record: id, protocol, network, amount, payer, reference, resource, timestamp. Stored in memory or Cloudflare KV.

What it speaks

Each adapter was written from the protocol's published specification and is exercised by tests against a fake facilitator, a fake Lightning backend and a fake mppx instance.

Protocol	Backed by	Status here
x402 v2 PAYMENT-SIGNATURE	Coinbase, Linux Foundation	implemented v1 `X-PAYMENT` is refused
L402 macaroon plus preimage	Lightning Labs	implemented HMAC macaroon, pluggable invoice provider
MPP WWW-Authenticate: Payment	Stripe, Tempo	implemented delegates to an mppx instance you construct
AP2	Google	stub pre-release; it authorizes, it does not settle
Skyfire	Skyfire	stub seller services need their approval

Using it

No dependencies, Fetch API only, so it runs on Cloudflare Workers, Deno, Bun and Node 18 or newer. Nothing is published to a package registry yet, so you copy src/ in or add the repo as a git dependency.

worker.js

import { createRouter, x402Adapter, l402Adapter, mppAdapter, memoryReceipts }
  from "./src/index.js";

const router = createRouter({
  price: { amount: "0.01", currency: "USD" },
  adapters: [
    x402Adapter({ facilitatorUrl: "https://x402.org/facilitator", payTo, network: "eip155:8453" }),
    l402Adapter({ invoiceProvider, rootKey, amountMsat: 1000 }),
    mppAdapter({ mppx, amount: "0.01" }),
  ],
  receipts: memoryReceipts(),
});

export default { fetch: (req) => router.handle(req, (req, receipt) =>
  Response.json({ data: "…", paidWith: receipt.protocol })) };

What it does not do

Stated plainly, because a payment library that oversells itself costs somebody real money.

No settlement has ever run on a live network from this code. Every test uses a fake facilitator, a fake Lightning backend and a fake mppx. The next step is Base Sepolia with a funded test wallet.
x402 v1 is refused, not accepted. An X-PAYMENT header gets an error telling the caller to speak v2. A service already taking v1 payments would lose those callers.
There is no client side. This takes payment. It does not make one.
Costs are not hidden but they are not absorbed either. Coinbase's facilitator is free for the first 1,000 on-chain settlements a month and $0.001 after that, which at cent-level prices is a large share of revenue.

Prior art

This was built believing nothing like it existed. That was wrong, and saying so is cheaper than letting somebody else find out.

PayMux (MIT, npm paymux, published March 2026) is the same core idea: one middleware returning a 402 with every configured protocol's requirements, plus a client SDK that auto-detects and pays. It covers x402 and MPP, with Visa's Trusted Agent Protocol planned.
Where this one differs: Lightning through L402, which PayMux does not do and has not planned, and a portable receipt format across protocols.
Where PayMux is ahead: it has a client SDK with spending limits, sessions, retries and timeouts. This has none of that. It has also been through a documented audit of its MPP path.
Worth knowing: MPP's own documentation lists Lightning Bitcoin as a payment method, so MPP alone may cover the Lightning case, which narrows even the difference above.