Kobaru is a public facilitator. You can verify and settle payments without an account.Every x402 facilitator is open by design: a merchant points its x402 middleware at the facilitator URL and payments work. Kobaru follows that model. An API key is not a gate to the facilitator. It unlocks the Kobaru products built on top of it.
The two tiers#
| Tier | How you get it | Who it's for |
|---|
| Public | Call gateway.kobaru.io without an Authorization header | Merchants using a standard x402 SDK who only need a facilitator, and anyone testing |
| Registered | Send an API key created in the Kobaru Console | Merchants who want the proxy, Effortless MCP, the console and the full facilitator feature set |
A request without an Authorization header runs in the public tier. A request with a malformed, unknown or revoked key gets 401 Unauthorized; it never falls back to the public tier.
What each tier gets#
| Feature | Public | Registered |
|---|
POST /verify and POST /settle | ✅ | ✅ |
GET /supported | ✅ Networks and schemes | ✅ Networks, schemes and usage extensions |
| Networks | The networks enabled for public access | The networks enabled for your account |
| Gas paid by the facilitator | ✅ | ✅ |
Usage models (pay_per_request limits, pay_per_time) | ❌ | ✅ |
| Bazaar discovery: schemas, pricing, description, method | ✅ | ✅ |
| Bazaar discovery: tags, title, provider info | ❌ Silently dropped | ✅ |
Transparent proxy (access.kobaru.io) | ❌ | ✅ |
| Effortless MCP | ❌ | ✅ |
| Kobaru Console: payment history, analytics, API keys, services and routes | ❌ | ✅ |
The proxy, Effortless MCP and the console need an account because they act on your behalf: they hold your routes, your upstream credentials and your payment history.Discovery filtering never fails a payment. You can send enrichment fields from the public tier; they are just not stored. See the feature gating reference.
Limits#
Both tiers are protected by Kobaru's firewall at the network layer. The public tier will get stricter limits of its own, so that the gas Kobaru pays for public traffic stays bounded:a lower rate limit than registered accounts;
a cap on the gas the facilitator spends on public traffic per time window.
429 or 503 with a Retry-After header. It does not report the payment as invalid. If your traffic needs predictable throughput, use an API key.
Moving to the registered tier#
Nothing about your payment flow changes. Create an API key in the console and pass it to your facilitator client: Modified at 2026-10-21 21:04:55
