Documentation Index
Fetch the complete documentation index at: https://docs.nevermined.app/llms.txt
Use this file to discover all available pages before exploring further.
The Problem
When a subscriber has multiple active delegations across their enrolled cards, the agent needs to know which one to use. Should it charge the 10 Stripe delegation on Card B? NVM Pay solves this with a three-tier selection algorithm that automatically resolves the right delegation based on priority rules. The algorithm is the same for Visa, Stripe, and Braintree —apiKeyId and explicit delegationId work identically across all three networks.
Three-Tier Resolution
When the SDK or CLI requests an x402 access token, NVM Pay resolves the delegation in this order:Mode 1: Explicit Delegation ID
If the caller passes a NVM Pay validates:
delegationId in delegationConfig, NVM Pay uses that delegation directly. No ambiguity, the caller knows exactly which authorization it wants.- TypeScript
- Python
- The delegation exists and is
Active(not expired, exhausted, or revoked) - The delegation has remaining budget and remaining transactions
- If the delegation is linked to an API key, it must match the calling key
- The associated card is active and belongs to the authenticated user
This is the only supported mode for Visa delegations. Auto-creation from the SDK requires
consumerPrompt + assuranceData, which the SDK cannot produce — see the Visa enrollment notes.Mode 2: Key-Linked Delegation
If no
delegationId is passed, NVM Pay checks if any delegation is linked to the calling API key. If exactly one key-linked delegation matches, it’s selected automatically.This is the recommended approach for production setups with multiple delegations. Link each API key to a specific delegation and the routing is deterministic.NVM Pay collects all delegations where delegation.apiKeyId === calling_key.skId, then filters for Active, with remaining budget, remaining transactions, and a non-expired duration. Key-linked delegations always take priority over unlinked ones.Decision Flowchart
When to Use Each Mode
Explicit ID
Multiple delegations, full control. Required for Visa.
Key-Linked
One delegation per API key. Set it once, forget it.
Unlinked
Single delegation, zero config. Just create and go.
Linking an API Key
API key linking works the same way for Visa, Stripe, and Braintree delegations through the sharedapiKeyId field on POST /api/v1/delegation/create.
When Creating
In the Nevermined Pay dashboard, open the Create Delegation dialog and select an API key from the dropdown. Only active, non-browser API keys that aren’t already linked to another delegation are shown.When Updating
Delegations cannot be updated in place. To change the linked API key, revoke the existing delegation and create a new one with the desiredapiKeyId. For Visa, this requires a fresh device-binding ceremony.
Linking an API key is optional but recommended when you have two or more active delegations. Without it, NVM Pay can’t automatically determine which one to use and will return an error.
Error Handling
Multiple Delegations Found
delegationId explicitly in delegationConfig, or link one of the delegations to your API key in the dashboard.
No Active Delegation Found
- All delegations are exhausted (
amountSpentCents >= spendingLimitCentsortransactionCount >= maxTransactions) - All delegations have expired (
createdAt + durationSecsin the past) - Delegations are linked to a different API key
Delegation Linked to Different Key
delegationId you passed is linked to a different API key than the one you’re authenticating with. Use the correct API key, or revoke the delegation and recreate it with the API key you want.
API Reference
Generate Access Token
| Field | Required | Description |
|---|---|---|
planId | Yes | The plan you’re paying for |
agentId | No | Agent identifier (for plans with multiple agents) |
delegationConfig.delegationId | No | Explicit delegation ID (Mode 1). Omit to use auto-resolution. Required for Visa. |
delegationConfig.spendingLimitCents + durationSecs | No | Auto-create a delegation on the fly (Stripe / Braintree only) |
accessToken value (a base64-encoded x402 PaymentPayload) goes in the payment-signature HTTP header when calling a protected resource.
Error responses:
| Status | Reason |
|---|---|
| 400 | Multiple delegations, delegation exhausted, missing required fields for Visa |
| 403 | Delegation linked to a different API key, delegation doesn’t belong to user |
| 404 | No active delegation found, delegation ID not found |
Best Practices
- Start simple. If you have one delegation, you don’t need to link API keys or pass explicit IDs. Just create the delegation and call the API.
- Link keys for production. When you add a second delegation, link each API key to a specific delegation. This gives you deterministic routing without code changes.
-
Use explicit IDs for Visa or for complex setups. Visa delegations require
delegationIdindelegationConfig. The same pattern is useful when an agent works with multiple delegations dynamically (e.g., different delegations for different pricing tiers). -
Monitor usage. Check
amountSpentCentsvsspendingLimitCentsandtransactionCountvsmaxTransactionsto know when delegations are close to exhaustion. Create new ones before the old ones run out. -
Set reasonable expiration times. Don’t create delegations that last indefinitely. Set
durationSecsaligned with your billing cycles. For Visa, theassuranceDataceremony scales with the duration shown in the approval prompt — keep it short for higher-trust use cases.