The payment challenge hides in three different places

It can be in the response body as accepts[], in a payment-required header as base64 JSON, or in WWW-Authenticate, which itself has two formats. Parse only the body and a large share of the market looks broken.

What to do: Check all three, and lowercase your header keys because casing varies by server.

Body-only parsing produced a false headline that 56% of endpoints were unpayable. The real figure was near zero.