Paste an endpoint.
See whether an agent can pay it.
Nine rules, scored out of 100, against the x402 v2 challenge your endpoint returns. Read-only: the check sends no payment and asks for no key.
Public endpoints only. One GET, eight-second timeout, no retries.
What it checks
- Returns 402 — not 200, not 401, not a redirect chain.
- The body is a v2 challenge —
x402Version: 2with a non-emptyacceptsarray. - Discoverable — body or the
payment-requiredheader, decoded. - Scheme is known —
exact,upto,batch-settlement. - Amount is an atomic integer —
"10000", not0.01and not v1'smaxAmountRequired. - Asset is canonical USDC on the network the entry advertises.
- EVM clients can sign —
extra.nameandextra.versionpresent, so the EIP-712 domain exists. - Browser clients can read it — a permissive
access-control-allow-origin. - Timeout is sane —
maxTimeoutSecondsbetween 30 and 600.
Weighted 20/15/5/5/20/15/10/5/5. Rules that a response gives you nothing to check are marked not applicable and excluded from the score, so an endpoint that does not speak x402 is graded on three rules, not punished on nine.
Live examples
Real endpoints, checked just now — not clients, not mockups:
api-xpay /quote x402scan resources blockrun completions a broken one
The 402 Install — CAD 750
A payment-required path in front of up to three of your endpoints, deployed into your own Cloudflare account. You own the repo, the account and the domain.
- Before-and-after conformance report from the same nine rules, so a third party can re-run it.
- One real settlement: USD 0.01 paid against your endpoint on Base mainnet, with the transaction hash and the returned 200 in the report.
- A GitHub Action that re-runs the rules on every push and fails the build if the 402 body drifts.
- Ten lines of README and fourteen days of bug fixes.
CAD 275 for the diagnosis alone, credited against the install within 30 days. Three business days from access; if that slips, half is refunded automatically. Not included: custom pricing logic, prepaid balances, invoicing or tax handling, KYC, ongoing hosting, or a volume guarantee.
For the list-builders
The same result as JSON: /api/check?url=…. The checker is MIT-licensed (LICENSE) and the rules are in one file — src/rules.ts — if you would rather run it yourself.