Fetched 2026-11-07 01:40 UTC · 409 ms · 1511 bytes
https://www.api-xpay.com/x402/quote
$0.00500 / call
Base · USDC
A95/100 · 1 rule failed
R8 costs the most. Add access-control-allow-origin for the 402 response.
| Wt | Rule | What the response shows | |
|---|---|---|---|
| ✓ | 20 | R1 Returns 402 Payment Required | 402 returned in 409 ms. |
| ✓ | 15 | R2 Body is a valid x402 v2 challenge | x402Version 2, 1 accept entry. |
| ✓ | 5 | R3 Challenge discoverable | Parsed from the body. |
| ✓ | 5 | R4 Payment scheme is known to clients | The only scheme in exact. |
| ✓ | 20 | R5 Amount is an atomic integer | Amount string 5000. |
| ✓ | 15 | R6 Asset is canonical USDC on that network | 1 accept entry on Base, asset is the canonical USDC contract. |
| ✓ | 10 | R7 EVM clients can sign | extra carries name and version on 1 EVM accept. |
| ✕ | 5 | R8 Browser clients can read the challenge | No permissive access-control-allow-origin on the 402. Hosted agents are fine; browser agents and embedded widgets are not.Fix: Add access-control-allow-origin for the 402 response. |
| ✓ | 5 | R9 Payment timeout is in a sane band | 60s. Accepted by clients between 30s and 600s. |
What the endpoint advertised
| Network | Scheme | Amount | Asset | Timeout |
|---|---|---|---|---|
| eip155:8453 | exact | 5000 | 0x833589fCD6… | 60 |
The raw challenge
Parsed from the body. Nothing here is inferred — this is the bytes the endpoint returned.
Show raw
{"x402Version":2,"error":"PAYMENT-SIGNATURE header is required","resource":{"url":"https://www.api-xpay.com/x402/quote","description":"Payment quote with amount, asset, and merchant wallet","mimeType":"application/json","serviceName":"X Pay","iconUrl":"https://www.api-xpay.com/logo.png","tags":["payment","quote","pricing","merchant","invoice"]},"accepts":[{"scheme":"exact","network":"eip155:8453","amount":"5000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0x589a2314a2E05F45e40C4823Da3Ba58D421dB3d8","maxTimeoutSeconds":60,"resource":"https://www.api-xpay.com/x402/quote","extra":{"name":"USD Coin","version":"2"}}],"extensions":{"bazaar":{"info":{"input":{"type":"http","method":"GET"},"output":{"type":"json","example":{"success":true,"service":"X Pay","quote":{"amount":"0.005","asset":"USDC","network":"base","payTo":"0x589a2314a2E05F45e40C4823Da3Ba58D421dB3d8","protocol":"x402","requestId":"req_abc123"}}}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"input":{"type":"object","properties":{"type":{"type":"string","const":"http"},"method":{"type":"string","enum":["GET","HEAD","DELETE"]},"queryParams":{"type":"object","additionalProperties":{"type":"string"}},"headers":{"type":"object","additionalProperties":{"type":"string"}}},"required":["type","method"],"additionalProperties":false},"output":{"type":"object","properties":{"type":{"type":"string"},"example":{"type":"object"}},"required":["type"]}},"required":["input"]}}}}The 402 Install — CAD 750
This check tells you what is wrong. The install puts a payment-required path in front of up to three of your endpoints, in your own Cloudflare account, and proves it works: a before-and-after report, one real settlement of USD 0.01 on Base with the transaction hash, a CI check that fails the build if the 402 body drifts, and fourteen days of bug fixes.
CAD 275 for the diagnosis alone, credited against the install within 30 days. Delivered in three business days from access. If delivery runs past three days, half is refunded automatically.