SiftwrightCheck an x402 payment endpoint
Paste a pay-per-call URL. We make one unpaid request, decode the 402 Payment Required response and check what an agent or wallet will see: version, price in USDC, network, payTo address, resource description, discovery metadata and browser CORS.
Try: x402.org/protected (the protocol's public testnet demo)
What the checker looks at
Only what any client sees before paying. It never signs or sends a payment.
The 402 itself
Does an unpaid request get 402 Payment Required, and do the requirements decode from the PAYMENT-REQUIRED header (v2) or the JSON body (v1)?
Price and network
Each option's scheme, CAIP-2 network, amount in atomic units and in USDC, asset contract and timeout. Testnet-only endpoints are flagged.
payTo address
Valid EVM or Solana address for the network, and never the zero address. EVM exact options need the token's EIP-712 name and version in extra.
Resource
Whether resource.url matches the URL you called, and whether the description tells an agent what it is paying for.
Discovery
Whether the bazaar extension publishes input and output schemas, so agent marketplaces can list and call the endpoint correctly.
Browser CORS
Whether web apps can read PAYMENT-REQUIRED and send PAYMENT-SIGNATURE, checked with a real preflight.
Check it yourself with curl
Print the decoded v2 payment requirements of any endpoint:
curl -s -D - -o /dev/null https://api.example.org/paid \
| grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' \
| base64 -d | python3 -m json.toolFor v1 endpoints the same JSON is in the response body: curl -s https://api.example.org/paid.
Why a checker?
An x402 client decides whether and how to pay from a few fields. A typo in the network id, an amount sent as a number instead of a string, a preview-deployment URL in resource.url or a missing CORS header fails silently: the agent simply moves on. This page shows those fields the way a client parses them.
Building for agents?
Siftwright's web-data API (YouTube transcripts, screenshots, Google News, contact details and more) is available over REST and a hosted MCP server. Two more free checkers for agent builders: the MCP server checker and the AI crawler checker.
Frequently asked questions
What is x402?
x402 is an open protocol for paying for an HTTP request with a stablecoin such as USDC. The server answers an unpaid request with 402 Payment Required and a description of what it accepts. The client signs a payment, retries with a PAYMENT-SIGNATURE header, and a facilitator verifies and settles it. It lets AI agents and scripts pay per call without an account or API key.
What does the checker do?
It sends one unpaid request (GET or POST with an empty JSON body), decodes the payment requirements from the base64 PAYMENT-REQUIRED header (v2) or the JSON body (v1), and checks them: protocol version, resource URL and description, each payment option's scheme, network, amount, asset and payTo address, testnet versus mainnet, discovery metadata, and the CORS headers that browser-based clients need. It also sends one CORS preflight (OPTIONS).
Does it pay, sign or move any money?
No. The checker never creates, signs or submits a payment and holds no wallet. It only reads what the endpoint publishes to anyone who asks. Prices are shown in USDC for well-known USDC contracts; other assets are listed in atomic units.
Which networks and versions does it understand?
x402 version 2 (CAIP-2 network ids such as eip155:8453 for Base) and version 1 (short names such as base or base-sepolia). It labels Base, Ethereum, Polygon, Arbitrum, OP Mainnet, Avalanche and Solana plus their common testnets, and recognises the official USDC contracts on them. Unknown networks or assets are reported, not treated as errors.
Why does it warn about resource.url?
A v2 payment is signed for a specific resource. If the URL in the requirements differs from the URL a client actually called (a different domain, often a preview deployment), some clients and facilitators reject the payment or users get confused about what they paid for.
Is this financial advice or a list of endorsed services?
No. It is a technical protocol checker for developers. It says nothing about whether a service is trustworthy or worth paying for, and nothing on this page is investment advice.
What do you keep?
Nothing beyond a 10-minute cache of the result keyed by URL and method. About 30 checks per day per network are allowed. Requests go out with the user agent SiftwrightX402Checker/1.0. Public hostnames over https only; no IP addresses, custom ports or redirects.
Give your agents web data
One key, nine tools over REST or MCP. Plans from $29/month; failed requests are free.