L402 vs Mastercard Agent Pay

L402

Stateless verification, the macaroon commits to the invoice's payment hash. Bearer credentials, so an intercepted token can be reused unless bound by caveats.

Mastercard Agent Pay

Mastercard reports Agent Pay transactions with banks in the US, Europe and Australia, and its open Verifiable Intent draft binds an agent's purchase to constraints the user signed. Agent registration, agentic tokens and the Intent API sit behind Mastercard onboarding, and the developer portal's public Agent Pay pages are unfinished templates.

L402

1. Run lnget with --max-cost and --max-fee set
2. Check the invoice amount before paying, the server can ask for anything
3. Accept both LSAT and L402 in challenges, servers still send both
4. Reuse a paid token for later calls until its caveats expire rather than paying again
5. Keep macaroons and preimages out of logs, they're bearer credentials

Mastercard Agent Pay

1. Don't plan to call Agent Pay directly. Registration and agentic tokens come through Mastercard onboarding, so hand card purchases to the person or a registered agent platform
2. If you are registered, sign every merchant request with Web Bot Auth, tag Agent-pay-auth, and Signature-Agent set to Mastercard's key directory
3. Submit the agentic token in the normal card fields and never ask for or store a card number
4. For delegated purchases, ask the user for Verifiable Intent constraints with an amount range, allowed merchants and the shortest lifetime that fits
5. Read the merchant guides on developer.mastercard.com as Markdown. The Agent Pay docs section there has no public content