x402

​

What to send

​

Checks on the payload

• The dollar value is shown only when asset is the canonical USDC contract for the network (Ethereum, Base, Polygon, Arbitrum or Base Sepolia). Any other asset is shown as raw units of an unrecognized token.
• An extra.name that does not match canonical USDC’s EIP-712 domain name, which suggests spoofed terms.
• A scheme other than exact or upto. With upto, the signature authorizes a maximum and the seller settles actual usage.
• An unknown network, a testnet, a payTo that is not an EVM address, and an amount that is not an integer.
• maxTimeoutSeconds above 3,600, a plain http:// resource URL, and a missing resource URL.
• The classifier never copies the seller’s resource description or 402 error text into its summary or notes. If either contains text aimed at the verifier, a note flags it as a manipulation attempt and requires a BLOCK.
• For signed payloads, the time left before validBefore, or that it has passed.

​

Live checks

1. Live terms. It requests the resource URL itself (GET, then POST if the server answers 405, without following redirects) and decodes the 402 from the PAYMENT-REQUIRED header or the body. It compares scheme, network, asset, payTo and amount with the quoted terms and reports a match, a price mismatch, terms the endpoint does not offer, or a status other than 402. Local and private addresses are never requested. Cached for 60 seconds.
2. Vendor history. It searches the Coinbase x402 Bazaar for the resource’s host. For a listing with the same payTo, it reports paid calls and unique payers over the last 30 days and the last payment date, and flags fewer than 5 payers. No listing is noted as a caution. Cached for 5 minutes.
3. Payee profile, on Base and Ethereum: whether payTo is a contract, and its USDC balance.
4. Payer checks, for signed payloads on Base and Ethereum: whether the payer holds enough USDC, and whether it has EIP-7702 delegated code, which would stop the signature from settling.

​

Examples

import { decodePaymentRequiredHeader } from "@x402/core/http";

const paidUrl = process.env.PAID_URL!; // the x402 endpoint your agent is about to pay

const probe = await fetch(paidUrl); // an unpaid request stops at the paywall
const header = probe.headers.get("PAYMENT-REQUIRED");
if (probe.status !== 402 || !header) throw new Error("no x402 payment terms");
const terms = decodePaymentRequiredHeader(header);

const res = await fetch("https://harness.chance.cc/api/v1/intent", {
  method: "POST",
  headers: { "x-api-key": process.env.CHANCE_API_KEY!, "Content-Type": "application/json" },
  body: JSON.stringify({
    intent: "Research agent. May buy API data up to $1 per call, USDC on Base only, from established vendors.",
    venue: "x402",
    action: terms,
  }),
});
const result = await res.json();
if (result.verdict !== "ALLOW") throw new Error(result.reasoning ?? result.error);
// Only now sign the payment with your x402 client and retry the request.

CODE=$(curl -s https://harness.chance.cc/api/v1/credits -H "x-api-key: $CHANCE_API_KEY" | jq -r .topup.accountCode)

TERMS=$(curl -si -X POST "https://harness.chance.cc/api/v1/credits/topup?credits=20&account=$CODE" \
  | awk -F': ' 'tolower($1) == "payment-required" { print $2 }' | tr -d '\r' | base64 --decode)

curl -X POST https://harness.chance.cc/api/v1/intent \
  -H "x-api-key: $CHANCE_API_KEY" -H "Content-Type: application/json" \
  -d "$(jq -n --argjson terms "$TERMS" \
    '{intent: "May top up verification credits, at most $5 at a time, USDC on Base only.", venue: "x402", action: $terms}')"

​

From an MCP client