What 68 x402 endpoints taught us about agent-payability

Description and use

All 59 endpoints with a valid 402 challenge were constructible by a stock client. Failures stemmed from listing issues, missing discovery metadata, and non‑GET‑friendly routes.

Problem

Determine whether stock buyer clients can pay x402 endpoints without custom code or workarounds.

Outcome

Every endpoint that presented a valid x402 v2 challenge was constructible by a stock client. Failures were due to incorrect listings, missing discovery metadata, or non-GET-friendly routes.

Workflow

• Probe each URL with an unpaid GET to capture the 402 response and PAYMENT-REQUIRED header.
• Decode the base64-encoded challenge and validate its structure (x402Version, accepts[], amount, payTo, extra).
• Check discovery surfaces: /llms.txt, /openapi.json, /.well-known/x402.
• Simulate a stock-client payment locally using the same signing path as @x402/fetch.
• Run the free checker at https://tel-multimedia-breathing-either.trycloudflare.com/audit?url=<your-endpoint> to get a score and fix list.

Evidence

All 59 had a decodable PAYMENT-REQUIRED header, sane accepts[] (eip155:8453, native USDC, correct EIP-712 domain fields), and produced a valid payment payload.

Source

The 9 non-402 appearances broke down as: 1) Method/URL mismatch (5× 405). 2) Unpaid pages in discovery docs (2× 200). 3) Parameterized URLs probed bare (2× 404).

Source