Sign what you hold.
Lock it in a contract you can read.

Authorization is a signature. Custody is a smart contract with two exits. Atum’s services are neither.

Signed by them. Held by them.

Someone has to hold it.
You send. It sits in their account. They pay the other side later. Until they do, you are on their books, and they can send it somewhere you did not authorize.

Signing and holding get bundled as one job.
The party that can authorize spending is also sitting on the money. Fire them, and you have to move the funds, too.

Machine payments still hand someone a wallet.
You gate a route, a facilitator is supposed to settle it. This usually means that the facilitator holds the key that sends the payment, not the merchant’s app.

Approve looks like handing over the account.
People know “approve” as a blank check: the contract can pull whenever it wants. This one cannot. Nothing leaves until you authorize a specific amount to a specific destination (and if you never do, the contract cannot take a cent).

The pairing is optional.

Payment infrastructure usually treats custody and authorization as the same trust. You give someone the right to move funds because they also hold the funds. That pairing is optional, not mandatory.

Custody and authentication can be a shared responsibility. The payer can sign a bounded authorization, a contract on the source rail can hold or release the tokens, and the network can coordinate delivery without taking the keys or the balance. Atum’s services verify signatures and attest the two legal exits. They do not run a payment account.

A payment can be authorized without Atum holding the keys or the funds.

Sign. Lock. Relay.

Atum coordinates a payment you already authorized. You sign on your machine. Source funds lock in a settlement vault on the rail they started on. An independent operator delivers on the destination rail. Atum never holds the tokens and never sees the payer’s private key.

SIGN. The payer authorizes. Atum verifies.
Each payment carries a signature from the source account. The gateway checks it. Signing stays on your side of the API.

LOCK. The vault holds. Two exits.
Tokens sit in a published contract on the source rail, not in an Atum balance. The only terminals are pay the operator after delivery is proven, or refund the payer. No path pays anyone else.

RELAY. Services coordinate. No settlement wallet.
The x402 facilitator verifies a payment credential and hands it to the network. It holds no settlement key. Independent operators execute. Direct 402 (MPP) skips the facilitator: your server verifies the same credential in-process.

You submit a signed payment request: who pays, from which rail, to which recipient, with a cap. An independent settlement operator delivers on the destination rail. Delivery is attested. The vault then releases to that operator, or it refunds you. You receive a receipt from both rails. You never send tokens to Atum.

Yours to sign. Not ours to hold.

Keep the keys that authorize spend. The payment is a signature you produce. Atum validates it. Your key never crosses the API boundary.

Keep funds out of an operator account. While the payment is in flight, the tokens are in a contract with two exits. There is no Atum function that pays a third address.

Let software pay without a facilitator wallet. A program signs a credential and retries. In this network the facilitator has nothing to settle from. Your server and the facilitator see proof of payment, not funds.

• Not a custodian. Funds lock in a settlement vault, not an Atum account.
• Not a signer for the payer. Atum checks a signature; it does not produce one for the source account.
• Not a facilitator with a settlement wallet. Operators execute; the facilitator advertises no signers.
• Not unlimited pull. A Permit2 approval is setup; each payment is a separate signature into the vault.
• Not delegated session keys. The flows that ship have the payer hold the key. Agent credentials and signing on your behalf are not this product.

Sign what you hold.
Lock it in a contract you can read.

The keys stay with the payer. The funds stay in a vault with two exits. Atum’s services verify and coordinate. They do not hold either.

A payment can be authorized without Atum holding the keys or the funds.