agentsiteaudit · Checks · AI agent readiness

x402 price tags: make sure AI agents can pay for your API

x402 lets an AI agent pay for an API call on the spot, usually a fraction of a dollar in a stablecoin. When the agent calls a paid address without paying, the server answers with HTTP 402 Payment Required and a price tag: how much, in what currency, on which network, and where to send it.

If that price tag is missing or incomplete, the agent cannot pay, and the sale is lost without anyone noticing. This check reads the paid addresses listed in your /.well-known/x402 file and asks each one for its price. It never pays.

In our November 2026 study of businesses selling to AI agents, 31% of the 290 websites whose paid resources we could check had at least one price-tag problem. See the full study.

Why it matters

An agent cannot ask you what you meant. It either understands the price tag or moves on to another seller.

Problems often appear after an update: a route that starts serving content for free, a wallet address that goes missing, or a network written in an old format.

What our check looks for

• Pass: An advertised paid resource answers an unpaid request with a complete 402 price tag
• Warning: Served free, missing, refused for safety, or not matching the discovery file
• Fail: A 402 reply with missing or malformed payment requirements

Check ID agents.x402.price_tag · AI agent readiness · High priority

How to fix it

What a complete price tag contains (x402 version 2)

HTTP/1.1 402 Payment Required
PAYMENT-REQUIRED: <base64 of the JSON below>

{
  "x402Version": 2,
  "accepts": [{
    "scheme": "exact",
    "network": "eip155:8453",
    "amount": "10000",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "payTo": "0xYourWalletAddress",
    "maxTimeoutSeconds": 300
  }],
  "resource": { "url": "https://api.example.com/v1/data" }
}

This example asks for 0.01 USDC on Base. Every field matters: scheme, network, amount, asset, payTo and a timeout.

Use a maintained library

Coinbase x402 middleware for Node, Python or Go

Writing the 402 reply by hand is where most mistakes start. The official middleware builds the price tag from your settings and keeps up with the specification.

Test it without paying

curl -i https://api.example.com/v1/data

An unpaid request should come back as 402 with the price tag. If it comes back as 200 with the data, the route is giving it away for free.

Common mistakes

• A listed route that answers 200 with the content, so it is free to anyone.
• A missing payTo wallet address, or an amount written in dollars instead of the token's smallest units.
• The network written in the old style ("base") on a version 2 price tag, which expects "eip155:8453".
• The discovery file listing addresses that no longer exist after a rename.

Related checks

• llms.txt: how to add a guide for AI agents to your website
• Tell AI agents who your business is: name and contact details as structured data

Written by Derek Moore, who builds and runs websites for small UK businesses. Last checked 30 October 2026.