The l402_manifest directive turns a location into a discovery endpoint that emits a JSON description of every L402-protected route on the server. It is intended to live at /.well-known/l402-services (RFC 8615), making this instance self-describing to clients that have only the host.

location = /.well-known/l402-services {
    l402_manifest;

    # Optional: restrict who can scrape pricing details.
    # allow 10.0.0.0/8;
    # deny  all;
}

This is the agent-era equivalent of robots.txt or security.txt. An autonomous agent (or any client) given only https://example.com can fetch the manifest, learn which routes are paid, how much they cost, and which payment backends are accepted — without any out-of-band integration.

{
  "version": "1",
  "service": {
    "name": "Example API",
    "description": "Stock data API"
  },
  "payment_methods": [
    {
      "type": "lightning",
      "backend": "LNURL",
      "address": "hello@getalby.com"
    },
    {
      "type": "cashu",
      "mints": ["https://mint.minibits.cash"],
      "p2pk_supported": true,
      "challenge_header": "X-Cashu"
    }
  ],
  "routes": [
    {
      "path": "/protected",
      "price": {
        "type": "static",
        "amount_msat": 10000
      },
      "caveats_required": ["RequestPath = /protected"]
    },
    {
      "path": "/rate-limited",
      "price": {
        "type": "static",
        "amount_msat": 10000
      },
      "caveats_required": ["RequestPath = /rate-limited"],
      "rate_limit": {
        "max_requests": 2,
        "window_secs": 60
      }
    }
  ]
}

Dynamic (Redis-backed) pricing is not reflected in price.amount_msat — the manifest emits the static default. Dynamic prices change per request and would require a Redis round-trip per route to render accurately; that's out of scope for v1.

Operators may want certain paid routes to remain undiscoverable — private APIs, beta tiers, customer-specific endpoints. Use l402_manifest_hide; on the location:

location /internal-paid {
    l402 on;
    l402_amount_msat_default 100000;
    l402_manifest_hide;       # not advertised in /.well-known/l402-services
}

The route still enforces L402 normally. It just doesn't appear in the manifest's routes[] array.

The optional service block is read from environment variables at manifest-render time:

L402_SERVICE_NAME="Example API"
L402_SERVICE_DESCRIPTION="Premium financial data, paid per request."
L402_SERVICE_OPERATOR="npub1abcd..."   # Nostr pubkey, DID, or free-form
L402_SERVICE_CONTACT="ops@example.com"

All four are optional. Unset variables are omitted from the response so the manifest stays valid JSON even with no service metadata.

• Per-worker registry. The manifest registry is per-nginx-worker. On a multi-worker deployment, every worker sees the same routes (config is shared), so this is a non-issue for the manifest itself. (Unlike the l402_metrics counters, which use a shared-memory zone, the registry is read-only per-worker state and needs no cross-worker aggregation.)
• No authentication by default. Pricing information is public. Restrict the endpoint with allow/deny, an auth subrequest, or a firewall if competitors should not see your full pricing matrix.
• Reload behaviour. On nginx -s reload, new workers start with a fresh registry built from the new config. Old workers serve in-flight requests with their existing registry until they exit.

Without a manifest, every L402 integration is a bespoke wiring job: the client must be told the routes, prices, payment backends, and caveat formats out of band. With one, an agent can land on a host and onboard itself end-to-end:

GET /.well-known/l402-services  → learn the API surface
GET /protected                → receive 402 + bolt11 invoice
PAY the invoice               → get preimage
GET /protected with L402 auth → success

For autonomous agents — Claude tools, MCP servers, custom-built — this is the difference between L402 being a protocol and L402 being a discoverable web standard.