Skip to content

TRX-005Buy

x402 payment challenge offered

Checks whether your shop answers with an x402 payment challenge, the HTTP 402 scheme some agents use to pay per request.

What we check

x402 (version 2, 2025-12-09, x402 Foundation) lets a server answer HTTP 402 Payment Required with a machine-readable description of how to pay. In version 2 that is base64-encoded JSON in the PAYMENT-REQUIRED header, with x402Version 2, a resource, and an accepts list whose entries carry scheme, network, amount and payTo. Version 1 put the object in the JSON body with maxAmountRequired, and is still accepted. x402 is an industry specification, not an IETF standard, and defines no discovery document.

Why it matters

x402 targets per-request access to APIs, data and content, settled mostly in stablecoin; it has no cart, shipping or returns model, so most shops selling physical goods can ignore it. If you sell paid API or data access to agents, a correct 402 challenge is how an agent learns what to pay.

How we check

We read the home page the crawl captured and request /api once. We never pay. PASS when either answers 402 with a well-formed x402 object. WARN when the object is incomplete: missing fields, an empty accepts list, no resource in version 2, or a version that does not match where it was sent. FAIL on a bare 402 with no x402 payload, since platforms also use 402 for a closed or unpaid store. We SKIP when /api was bot-blocked, disallowed by robots.txt or refused, and when no 402 was seen at all: with no discovery document, we cannot tell whether another route takes x402 payments.

How to fix it

  1. Only act on this if you sell per-request access (APIs, data, content) to agents paying in stablecoin.
  2. Add x402 middleware (@x402/express, @x402/hono or @x402/next) to the paid routes so they answer 402 with payment requirements.
  3. Send the PaymentRequired object base64-encoded in the PAYMENT-REQUIRED header, with a resource and, in each accepts entry, scheme, network, amount and payTo.

What good looks like

HTTP/1.1 402 Payment Required
Content-Type: application/json
PAYMENT-REQUIRED: eyJ4NDAyVmVyc2lvbiI6Mi... (base64 of the JSON below)

{
  "x402Version": 2,
  "resource": { "url": "https://shop.example/api/stock" },
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "amount": "10000",
      "asset": "0x...",
      "payTo": "0x...",
      "maxTimeoutSeconds": 60
    }
  ]
}

Sources