The x402 Discovery Standard: How AI Agent Services Become Discoverable Without Gatekeepers

August 7, 2026

For the past year, finding an x402-enabled API meant one of two things: scrolling through a hand-curated directory, or already knowing the URL. There was no programmatic way for an agent to discover which services accepted USDC micropayments, which facilitators settled on which chains, or whether a domain even supported x402 at all.

That's about to change.

A new spec extension — x402 discovery (PR #2979), now also an IETF Internet-Draft — adds a standardized, zero-gatekeeper discovery mechanism to the x402 protocol. Any facilitator or resource server publishes one JSON file at /.well-known/x402 and optionally one DNS TXT record, and becomes discoverable by any client or indexer. No registration. No approval. No hand-curated list.

The Problem: Discovery Was Manual

x402 — the HTTP 402 Payment Required protocol revived for stablecoin micropayments — has seen explosive growth. As of August 2026, the ecosystem includes 40+ foundation members, multiple independent facilitators (Coinbase, Circle, Cloudflare Wallets, Stripe via OSL AgentPay), and hundreds of live endpoints serving AI agents with per-call pricing.

But discovery lagged behind the payment rails. Curated directories at x402.org and x402scan.com served as the primary indexes. While valuable, they introduced a structural bottleneck: every new service required manual listing, and there was no way for an autonomous agent to independently verify that a domain supported x402 without probing it.

The discovery layer was load-bearing human infrastructure in a protocol designed for machine autonomy. The spec fixes this.

How It Works

The discovery extension has two mechanisms, modeled on the proven MTA-STS pattern (DNS pointer → HTTPS authority):

1. The Well-Known Manifest

Every x402 facilitator or resource server publishes a JSON manifest at /.well-known/x402 (per RFC 8615). The manifest declares:

Facilitator metadata — baseUrl, endpoints, supported chain kinds (e.g. eip155:8453 for Base, solana), supported assets (USDC contract addresses)
Resources — optionally, the specific x402 endpoints this host serves (compatible with the bazaar endpoint format)
Peers — up to 32 peer facilitators, enabling discovery of a multi-facilitator ecosystem from a single entry point
Attestation claims — optional verifiable claims about the operator

Here's what a live manifest looks like (ours, on production):

GET https://minia2a.uk/.well-known/x402

{
  "protocol": "x402",
  "x402Version": 2,
  "name": "minia2a.uk",
  "payment": {
    "protocol": "x402",
    "network": "eip155:8453",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "receiver": "0xf16F0882de08315B438E9f3a2Abfb2d2E5d94ECA"
  },
  "facilitators": [
    "cloudflare-wallets",
    "coinbase",
    "circle",
    "stripe",
    "osl-agentpay"
  ],
  "paymentMethods": ["x402", "cloudflare.pay", "usdc"],
  "resources": [
    "https://minia2a.uk/x402/gas",
    "https://minia2a.uk/x402/recall",
    "https://minia2a.uk/x402/find"
  ]
}

2. The DNS TXT Pointer (Optional)

A single TXT record at _x402.<domain> can point clients to the manifest location, using a compact grammar:

_x402.minia2a.uk.  TXT  "v=x402-1; wk=https://minia2a.uk/.well-known/x402; k=eip155:8453"

The resolver algorithm is designed for resilience: try the TXT record first, fall back to the well-known URI at the canonical domain, and always cross-check against the live /supported endpoint — live data is authoritative over static records.

What the Census Data Shows

During the PR's review, community member meloliva14 ran a comprehensive DNS probe across 1,971 hostnames. The results paint a picture of a protocol in early but rapid deployment:

982 live manifests found at /.well-known/x402
11:1 path split — most hosts serve the manifest at the root path; about 8% serve it on a sub-path
Three DNS TXT records exist today, using a pre-standard v=x4021 format (the spec now mandates v=x402-1)
661 registrable domains across 1,521 hosts — significant platform concentration on Vercel (202 hosts), Cloudflare Workers (72), Railway (66), and Render (27)

The platform concentration is notable: a quarter of the deployed network sits on shared platform suffixes. The spec now mandates Public Suffix List-aware domain grouping for crawler frontier diversity — a detail that emerged directly from the census data during review.

What This Means for the Agent Economy

This spec changes the discovery layer from a curated directory to a regenerable cache. Any indexer can crawl the web, resolve /.well-known/x402 manifests, and build a complete map of the x402 ecosystem without asking anyone for permission. Curated directories don't go away — they become value-added layers on top of the crawlable base, rather than gatekeepers.

For agent developers, the practical implications are:

Zero-friction onboarding — deploy a manifest file, add an optional DNS record, and agents can discover your service automatically.
Multi-facilitator routing — a single manifest can declare support for multiple payment rails (Cloudflare Wallets, Coinbase, Circle, Stripe) in one document, letting agents choose their preferred settlement path.
Verifiable claims — the attestation field creates a path toward reputation systems where operators can make cryptographically verifiable claims about their service.

What's Still Missing

The spec is already strong, but a few gaps remain — some surfaced during the review process:

Brokered resources — A marketplace that aggregates services from other domains has no way to express "I list these endpoints, but they settle through these facilitators" in a single manifest. The current schema requires the client to re-resolve each domain individually.
Multi-facilitator settlement routing — A service that accepts payment through both Base USDC (via Coinbase) and Solana USDC (via Circle) can't express that routing mapping in the manifest today.
Rate limiting and capacity signaling — No standard field yet for declaring throughput limits, latency SLAs, or geographic regions.

These are solvable — the PR's collaborative review process (5 contributors, 31+ comments across 2 weeks) has already resolved half a dozen similar design questions through census data, adversarial testing, and iterative schema refinement.

Why Discovery Matters Now

The timing is not accidental. In the last 60 days:

Cloudflare Wallets launched (August 4), adding a new x402-compatible payment rail with global edge distribution
Mastercard acquired BVNK for $1.8B, signaling institutional conviction in stablecoin payment infrastructure
Natural raised $30M (July 2026) to build dual fiat+stablecoin agent payment rails
Circle Agent Marketplace launched with 500+ endpoints (May 2026)
Google AP2 moved to the Linux Foundation with 22 corporate founders

The payment rails are being built by trillion-dollar companies. The discovery layer — where agents find services, compare pricing, and trial before committing — is the open frontier. Standardized discovery turns that frontier from a proprietary moat into a public good.

The Bottom Line

The x402 discovery extension is one of those quiet infrastructure standards that doesn't make headlines but reshapes what's possible. When every domain can declare "I accept agent payments here" with a single JSON file — and every agent can verify that claim by fetching one URL — the agent economy gets its DNS moment.

The PR is still open and under active review. If you operate x402 infrastructure, read the spec, deploy a manifest, and contribute your real-world feedback. The census data from the review process proved that production deployment data beats armchair architecture every time.

We deployed /.well-known/x402 on minia2a.uk in production. It took one file and zero downtime. If you run x402 services, do the same — the spec needs more real-world manifests to harden the resolver logic.