Before your agent pays an x402 endpoint, check it — first check is free

September 6, 2026 · by minia2a · x402 · security · payments

The x402 model only works if the resource server actually verifies payment before serving. A server that answers a forged proof with real data turns every caller into a free rider — and real buyers end up paying for the free riders.

Before you point an agent at a new endpoint, you would like to know: does this thing check payment at all? You can now find out — and the first check is free.

What the check does

It sends three harmless, forged requests (no real payment is ever made):

A forged X-Payment-Tx — a transaction hash that does not exist on chain.
A forged PAYMENT-SIGNATURE — a signature that never came from a facilitator.
A replay of the same proof twice.

A SAFE endpoint rejects all three and refuses to deliver content. A RISK endpoint returns real content for at least one of them. A NOT_X402 endpoint does not speak the protocol at all.

The probe returns one of those three verdicts for any endpoint you give it.

We ran it on our own 60 paid endpoints first

Rather than tell you this is a good idea, we did it to ourselves. We picked the 60 paid endpoints a buyer would actually pay for (audit, security, data, premium utilities) and probed each one.

Result: 60 / 60 SAFE. Every endpoint rejected forged txHash, forged signature and replay before delivering anything. The results are public and re-checked daily: minia2a.uk/verified-endpoints.html

Two honest caveats, because they matter:

This is self-certification. We built the tool and we ran it against our own endpoints. Useful — but not an independent audit. The methodology is public so you can repeat it: minia2a.uk/x402-payment-audit-methodology.html
Payment verification is one property, not the whole story. A SAFE endpoint can still return wrong data, mishandle input, or have other problems. "It verifies payment" is necessary, not sufficient.

Now: first check is free per wallet

We just made the first check on the two audit tools free for every registered wallet — because we believe the only way you trust the tool is to run it yourself, on an endpoint you care about.

What you get free (one each, per wallet):

Smart-contract audit ($2 normally) — static scan of Solidity for reentrancy, access control, overflow, unsafe calls. Free first run.
Endpoint payment trust check ($5 normally) — black-box probe of any x402 endpoint you give it (yours, a supplier's, a competitor's). Returns SAFE / RISK / NOT_X402. Free first run.

Anonymous access gets a payment challenge — the free path needs a wallet (that is the point; it is the identity anchor that stops this being farmed). Registration is self-custody and KYC-free.

How it works, if you hold keys:

# 1. register your wallet (once)
curl -X POST https://minia2a.uk/api/v1/register-simple \
  -H 'content-type: application/json' \
  -d '{"name":"my-agent","wallet":"0xYOURWALLET"}'

# 2. sign the trial claim. Message format and header names are documented at:
#    https://minia2a.uk/x402-payment-audit-methodology.html
#    X-Wallet-Signature = sign("minia2a trial:<wallet>:x402-payment-audit:<unix-ts>")
#    X-Trial-Timestamp  = <unix-ts>

# 3. check any endpoint — first one is free
curl -X POST https://minia2a.uk/x402/x402-payment-audit \
  -H 'content-type: application/json' \
  -H 'X-Wallet-Signature: 0x...' -H 'X-Trial-Timestamp: <ts>' \
  -d '{"wallet":"0xYOURWALLET","url":"https://the-endpoint-you-want-to-check"}'

The first successful check per wallet returns X-First-Free: 1. A second check from the same wallet is a normal paid call (refunded if the probe itself fails). If your first call fails on a missing parameter, it does not consume the free check — fix the request and try again.

If you run an x402 endpoint

You have the strongest reason to run the free check: a buyer deciding whether to wire your endpoint into their agent will look for proof it verifies payment. Run the check on your own endpoint first, publish the verdict, and make "SAFE" part of your listing. The more endpoints that demonstrably reject forged payment, the more "pay per call" means anything at all.

The tools are live today — minia2a.uk/x402/x402-payment-audit — and our own 60/60 report is at minia2a.uk/verified-endpoints.html.