Overview

TOLLA Network docs

TOLLA is a payment network for AI agents. An agent pays per request, in stablecoins, over the open x402 protocol and the Machine Payments Protocol (MPP, method evm). Payments settle in USDG on Robinhood Chain.

The network has six parts, named after a toll road: Lanes (the market of paid APIs), Scan (the explorer), Pass (the agent wallet), Booth (the merchant gateway), Plates (agent identity) and Receipts (proof of payment).

What's live

TOLLA is preliminary. This table is the source of truth and changes as parts ship. Beta means shipped and settling real tolls, but still changing. The first funded toll settled on 2 Nov 2026: 0.01 USDG, tx 0xb577…5b84 (a team test).

How a toll works

x402 uses the HTTP status code 402 Payment Required. A paid API answers an unpaid call with its price; the client pays and calls again. Through TOLLA, the steps are:

1. Call. The agent sends a normal HTTP request to a lane.
2. Quote. Booth answers 402 with the price, the asset (USDG), the network (Robinhood Chain) and the address to pay.
3. Check. Pass compares the price with the agent's caps. Over a cap, it stops and signs nothing.
4. Sign. Pass signs a payment authorization for exactly that amount and sends the call again with it.
5. Serve, then settle. Booth verifies the authorization, runs the request, and settles only if the API answered successfully.
6. Receipt. The answer comes back with a receipt: payer, merchant, amount and transaction hash.

Pass and Booth are in beta. Fields may still change; this page will say when they do.

Booth

Booth puts any HTTPS API behind a 402. Open one at /booth after signing in with the wallet that should receive tolls (a message signature, no transaction). You get a public URL:

https://tolla.network/b/<booth-id>[/any/path?query]

• An unpaid call gets 402 with PAYMENT-REQUIRED: scheme exact, network eip155:4663, asset USDG, your price, your wallet as payTo.
• A paid call carries PAYMENT-SIGNATURE. Booth checks it matches the quote, checks it with the facilitator, then forwards the request (path and query appended) to your API with x-tolla-payer and x-tolla-receipt.
• Your API answers 2xx: the toll settles and the answer returns with PAYMENT-RESPONSE, TOLLA-RECEIPT and TOLLA-CHARGED. Any other answer, or none within 25 s: nothing settles and TOLLA-CHARGED: 0.
• No cut during beta. Tolls go from the agent's wallet straight to yours; the facilitator pays the gas.
• Open booths are listed first on Lanes (tagged TOLLA Booth) and in /.well-known/x402, a machine-readable list of booth URLs. Pass can pay all of them.

Facilitators and failover

Booth checks every payment signature itself first, then asks a facilitator to verify it: Elsa (facilitator.heyelsa.build), and if Elsa is down, Ultravioleta DAO (facilitator.ultravioletadao.xyz). Both list x402 v2 exact on eip155:4663 and need no key.

• Down (no answer, timeout, 5xx, 429): the next facilitator is tried. Two failures in a row bench a facilitator for 3 minutes.
• Refused (a readable "invalid" answer): final. A payment is never shopped around for a more lenient checker.
• The facilitator that verified a payment is the only one that settles it, and each receipt records which one it was.

Pass

Pass is the agent wallet: a CLI and an MCP server with caps the agent can read but not change. It pays lanes that accept USDG on Robinhood Chain.

npm install -g https://tolla.network/pass/tolla-pass-0.1.1.tgz
tolla-pass init            # new key, encrypted with your passphrase; prints the address
tolla-pass caps set perDay 10
tolla-pass call https://tolla.network/b/<booth-id>

Caps live in ~/.tolla/caps.json. Over any of them, Pass signs nothing:

{
  "perCall":     "0.05",   // USDG, largest single toll
  "perDay":      "5.00",   // USDG, rolling 24 hours
  "perMerchant": "1.00",   // USDG per host, rolling 24 hours
  "allow":       ["*"],    // or a list of hosts
  "network":     "eip155:4663"
}

MCP config (Claude Desktop, Claude Code and other MCP clients):

{
  "mcpServers": {
    "tolla-pass": {
      "command": "tolla-pass",
      "args": ["mcp"],
      "env": { "TOLLA_PASS_PASSPHRASE": "your passphrase" }
    }
  }
}

Tools: tolla_wallet, tolla_lanes, tolla_call (with an optional, stricter maxPrice) and tolla_spend. No tool edits caps or returns the key, and there is no export command.

Beta. Caps protect against an agent that only talks MCP; an agent with shell or file access to ~/.tolla can do anything you can. Fund a Pass with small amounts.

MPP

Booth also takes the Machine Payments Protocol, following the paymentauth.org drafts draft-httpauth-payment-01 and draft-evm-charge-00 (Internet-Drafts, not standards). An unpaid call gets both offers in one 402: the x402 quote and

WWW-Authenticate: Payment id="…", realm="tolla.network", method="evm",
  intent="charge", request="…", expires="…"

• The request asks for the booth price in USDG on Robinhood Chain (chainId 4663, 6 decimals), credential type authorization (EIP-3009). A challenge expires after 5 minutes and pays for one call.
• The agent signs a transferWithAuthorization for exactly that amount, with the nonce bound to the challenge, and sends Authorization: Payment <credential>.
• It settles through the same facilitators as x402 and only after the API answers 2xx. Success adds Payment-Receipt. Payment errors (402) are RFC 9457 problem details with a fresh challenge; your API's own error answers pass through unchanged.
• Not supported yet: the tempo, stripe and card methods; the permit2, transaction and hash credential types; sessions.

Receipts

Every paid attempt through Booth gets a receipt id, returned in TOLLA-RECEIPT, and a public page at /r/<id> (also in TOLLA-RECEIPT-URL).

GET /api/receipts/<id>   → status, payer, payTo, amountUsd, tx, explorer link
GET /api/tolls            → totals and the 10 latest receipts

Status is settled, unconfirmed (broadcast, not yet confirmed), not_charged (the API failed) or settle_failed (the facilitator refused; the answer was withheld and nothing moved).

Plates

Plates is a read-only explorer of ERC-8004 agent identities on Robinhood Chain. It reads the canonical registries: IdentityRegistry 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432 and ReputationRegistry 0x8004BAa17C55a88189AE136b182e5fdA19dE9b63. There is no official ValidationRegistry on Robinhood Chain, so validation isn't shown.

• An indexer reads the registry's events every 5 minutes. Agent cards are read a few at a time; only name, description, image and x402Support are kept, as plain text. TOLLA doesn't verify claims inside cards.
• A booth owner can link a booth to an agent. The link is accepted only if the signed-in wallet is the agent's owner, its agent wallet, or an approved operator, checked on-chain at link time.
• TOLLA never writes to the registries.

GET  /api/plates?q=&page=      search agents
GET  /api/plates/<agentId>      live owner, wallet, reputation, linked booths
POST /api/plates/link           { boothId, agentId }  (signed in)

Status

Status publishes TOLLA's own measurements every 5 minutes: the API, the Booth tables, each facilitator, the Robinhood Chain RPC and the x402 index, with 24-hour and 7-day uptime, latency and incidents. There is no contractual SLA during beta. GET /api/status returns the same data.

Public API

Lanes and Scan run on a free, read-only API. No key needed. Responses are JSON and allow any origin.

List lanes

GET /api/lanes
GET /api/lanes?q=weather

Without q: the 500 most active listings in the x402 index. With q: up to 20 matches. Each lane has url, name, method, networks, priceUsd, payers30d, calls30d, repeat (calls per wallet) and concentrated.

Scan summary

GET /api/lanes/scan

Totals for the top 500 lanes, top lanes by paying wallets, accepted networks, flagged lanes and lanes on Robinhood Chain.

Probe a lane

POST /api/lanes/probe
content-type: application/json

{ "url": "https://example.com/paid-endpoint" }

Makes one unpaid call to a listed lane and reports verdict: tolling (answered 402), open (answered 2xx without asking for payment) or down. Only URLs listed by /api/lanes can be probed. Results are cached for 10 minutes; 60 probes per hour per network.

How Scan counts

• Source. The public x402 Bazaar index run by Coinbase CDP, including its own 30-day counts of calls and distinct paying wallets per listing. TOLLA doesn't adjust them.
• Scope. The first 500 listings in the index's own activity order. The index holds far more, most with little or no recent activity.
• Paying wallets. Counted per lane. A wallet that paid two lanes counts once in each.
• Flag. A lane is flagged when fewer than 50 wallets average 100 or more calls each, or three wallets or fewer made 30 calls or more. A flag isn't proof of anything: one busy agent looks the same as volume that isn't organic.
• Freshness. Index pages are cached for 10 minutes.

Glossary

x402

An open protocol for paying over HTTP with the 402 status code.

MPP

Machine Payments Protocol, another open standard for agent payments.

USDG

A dollar stablecoin with 6 decimals; the toll currency on Robinhood Chain.

ERC-8004

An Ethereum standard for agent identity, reputation and validation registries.

Facilitator

A service that verifies x402 payment authorizations and submits them on-chain.

Lane

One paid API endpoint.