What Agents Buy.

How to pay an x402 endpoint

Everything below was learned by doing it, mostly by getting it wrong first. If you are trying to make an agent pay for an API and something is not behaving, start here.

What x402 is

x402 revives HTTP status code 402, "Payment Required", which sat unused in the spec for thirty years. You request a resource, the server answers 402 with a machine readable quote, your client signs a stablecoin payment, and retries with the payment attached. No API key, no account, no subscription, no invoice. The buyer can be software with a wallet and nothing else.

Payment is almost always USDC, most often on Base. The common scheme is called exact: pay this precise amount to this precise address. MPP, Stripe's Machine Payments Protocol, uses the same 402 pattern but is a separate protocol, so a client that speaks one does not automatically speak the other.

The four steps

1. Ask without paying. Send the normal request. A working endpoint answers 402 and includes the price, the asset, the chain and the destination address.
2. Read the quote. Never trust a price from a registry or a docs page. Read the live 402.
3. Sign and retry. Your wallet signs an authorisation for that exact amount and the request goes again with the payment attached. The private key stays on your machine.
4. Check what arrived. A 200 is not proof of delivery. Confirm the response actually contains the goods, and confirm on a block explorer that what left your wallet matches the quote.

The payment challenge hides in three places

This is the single most common reason a working endpoint looks broken. The quote can arrive in the response body as an accepts[] array, in a payment-required header as base64 JSON, or in WWW-Authenticate in either of two formats. Parsing only the body once produced a false headline here that 56% of endpoints were unpayable. They were not. Parse all three before you conclude anything.

Things that will catch you

• The wrong verb reads as a dead endpoint. Send GET to a POST only endpoint and you get a 404, 401 or 405 that looks like the service is gone. Read the declared method first. This falsely marked 118 live endpoints as dead in one run here.
• Decimals are not always six. USDC uses 6. Tokens on BNB Chain typically use 18. Assume 6 across the board and a one cent call reads as ten billion dollars, which is a mistake this site published and had to correct.
• Some sellers mint a fresh address per request. A changing payTo is not automatically a hijack. Probe twice before accusing anyone.
• A published quote is not a promise. At least one large seller publishes a valid standard quote and then refuses standard payment, accepting only its own proprietary client.
• Revenue is not revenue. Money arriving at a seller address is turnover. Several of the largest earners pay almost all of it straight back out, because they are games returning stakes or resellers paying suppliers.

What you need to pay with

The reference implementation is Coinbase's, published under Apache 2.0 with TypeScript, Python and Go SDKs. The helper packages @x402/fetch and @x402/axios handle the whole loop: catch the 402, parse it, check it against your ceiling, sign, retry. Roughly twenty lines if you build it yourself.

Managed options exist at every layer. Coinbase CDP is the broadest facilitator. Cloudflare ships agent wallets and MCP tooling. Circle has an agent stack. AWS does buyer side wallets and budgets. AgentCash, which pays for everything on this site, handles both x402 and MPP across chains and enforces a per call spend cap, which is the feature that has stopped a bad payment here more than once.

Where the endpoints are

Two public registries list what exists, both free and neither requiring auth: Coinbase's CDP discovery API and Circle's marketplace discovery. Be aware that neither is the universe. Measured here, CDP accounted for 3% of observed transactions and missed about 35% of all seller dollars, including at one point the second largest seller by revenue, because plenty of earning services never registered anywhere.

How the numbers on this site are produced

Settlement is swept daily straight from Base JSON RPC logs, reading USDC Transfer events into the payTo address each service advertises in its own challenge. Registry call counters are not used: one registry credited a service with 4,201 calls over thirty days while the chain showed 131,803 settlements in a single day. Grades come from buying the thing with a real wallet and checking what came back. Nobody pays to appear here and no grade is for sale.

See the ratings and the daily settlement tape, or read the field notes for the full list of traps.