How do I know an x402 endpoint is legit?
Three quick checks tell most of the story about an unknown x402 endpoint: whether it answers now, whether its live price matches its listing, and whether anyone has paid it more than once.
1. Does it answer right now?
A request without a payment to a working x402 endpoint returns HTTP 402 with a PAYMENT-REQUIRED payload: the price, the network, the asset and the payTo address. A timeout, a server error or a 402 without those fields means the endpoint is not ready to take a payment, whatever its listing says.
2. Does the live price match the listing?
Directories record a price at indexing time. The 402 challenge carries the current one. When the challenge asks for more than the directory shows, the listing is stale or the seller has repriced; either way the challenge is the amount that would actually be paid.
3. Has anyone paid it more than once?
Bazaar listings carry l30DaysUniquePayers and l30DaysTotalCalls. One or two payers usually means the seller's own activation payment. Repeat calls from the same payers mean someone is using the endpoint. Marketplace counters are reported by the marketplace and can be inflated or frozen, so they are a signal, not proof.
What Ontario's finder does
Ontario's x402 API finder (POST /api/x402/find-api, 0.005 USDC on Base) runs these checks across Coinbase's Bazaar for one task. It sends an unpaid request to up to eight candidates, keeps the endpoints that answered with a valid Base USDC challenge within the caller's budget, reports each one's live price, its price drift against the listing and whether the payTo address matches, and ranks by task fit, price and repeat buyers. Up to five results come back. If no endpoint answers, the call returns 404 and no payment is taken.
Ontario does not guarantee endpoint safety or service quality. A result records what the endpoint did at that moment, with a timestamp, and nothing more.
Take the next step
The pages below go deeper on this question.
Sources and observed evidence
Continue reading
Publish an x402 API profile with a readiness report and badge
Prepare your x402 API for agent discovery: validate free, inspect readiness evidence, then publish an Ontario service profile for 0.50 USDC only when you need it.
MCP Registry, Smithery or Bazaar: build the agent purchase path
Separate MCP installation from paid API discovery. Give agents a callable tool, free preflight, explicit payment requirements and evidence of fulfilled output.
Can x402 payments be refunded?
An x402 payment is a USDC transfer that is final once it settles, so a refund is a voluntary new transfer and the real protection is a seller that settles after the result exists.
How big is the x402 market?
Coinbase's Bazaar index lists tens of thousands of paid endpoints, but most show one or two payers in 30 days, and repeat demand sits in a few categories.
Are cheaper x402 APIs worse?
Not necessarily; price rarely decides which x402 API agents use, as a reseller that charges more than the original search API and gets more calls shows.
Do Claude or ChatGPT pay for MCP tools?
Claude and ChatGPT can call MCP tools, but neither pays for one by itself; a paid MCP tool needs a client wrapper with a funded wallet and a spending limit.
Which networks does x402 support?
x402 is network-agnostic; Coinbase's facilitator settles on Base, Solana, Polygon, Arbitrum, Monad and World, and most paid traffic today is USDC on Base.
How do I get my API discovered by AI agents?
Agents search indexes rather than browse websites, so an API is found through Coinbase's Bazaar, x402scan and directories, and through a description that names the task.