What 68 x402 endpoints taught us about agent-payability

说明与用途

所有59个返回有效402挑战的端点都能被标准客户端构造支付。错误主要来自列表错误、缺失发现元数据和非GET友好的路由。

问题

Determine whether stock buyer clients can pay x402 endpoints without custom code or workarounds.

结果

Every endpoint that presented a valid x402 v2 challenge was constructible by a stock client. Failures were due to incorrect listings, missing discovery metadata, or non-GET-friendly routes.

工作流

• Probe each URL with an unpaid GET to capture the 402 response and PAYMENT-REQUIRED header.
• Decode the base64-encoded challenge and validate its structure (x402Version, accepts[], amount, payTo, extra).
• Check discovery surfaces: /llms.txt, /openapi.json, /.well-known/x402.
• Simulate a stock-client payment locally using the same signing path as @x402/fetch.
• Run the free checker at https://tel-multimedia-breathing-either.trycloudflare.com/audit?url=<your-endpoint> to get a score and fix list.

证据

All 59 had a decodable PAYMENT-REQUIRED header, sane accepts[] (eip155:8453, native USDC, correct EIP-712 domain fields), and produced a valid payment payload.

来源

The 9 non-402 appearances broke down as: 1) Method/URL mismatch (5× 405). 2) Unpaid pages in discovery docs (2× 200). 3) Parameterized URLs probed bare (2× 404).

来源