What 68 x402 endpoints taught us about agent-payability

Описание и применение

Все 59 проверенных эндпоинтов с корректным 402‑заголовком были выполнимы клиентом без кастомного кода. Ошибки возникали из‑за неверных списков, отсутствия метаданных и некорректных методов.

Задача

Determine whether stock buyer clients can pay x402 endpoints without custom code or workarounds.

Результат

Every endpoint that presented a valid x402 v2 challenge was constructible by a stock client. Failures were due to incorrect listings, missing discovery metadata, or non-GET-friendly routes.

Рабочий процесс

• Probe each URL with an unpaid GET to capture the 402 response and PAYMENT-REQUIRED header.
• Decode the base64-encoded challenge and validate its structure (x402Version, accepts[], amount, payTo, extra).
• Check discovery surfaces: /llms.txt, /openapi.json, /.well-known/x402.
• Simulate a stock-client payment locally using the same signing path as @x402/fetch.
• Run the free checker at https://tel-multimedia-breathing-either.trycloudflare.com/audit?url=<your-endpoint> to get a score and fix list.

Доказательства

All 59 had a decodable PAYMENT-REQUIRED header, sane accepts[] (eip155:8453, native USDC, correct EIP-712 domain fields), and produced a valid payment payload.

Источник

The 9 non-402 appearances broke down as: 1) Method/URL mismatch (5× 405). 2) Unpaid pages in discovery docs (2× 200). 3) Parameterized URLs probed bare (2× 404).

Источник