I run an x402 store where the customers are AI agents.
In August I pointed a free checker at every host on the public x402
discovery list. One of them tried to sign its offers. Its signatures
did not parse.
x402 is the HTTP 402 payment flow Coinbase and Cloudflare revived for
agents: request a resource, get a 402 with the price and the address,
pay, retry. It works. Thousands of settlements a day go through it.
What it does not do, by default, is commit the seller to anything
before the money moves. The 402 says "this costs $0.01, pay here."
Nobody signed that. If the price changes between the challenge and
the settlement, or the payTo address was swapped by whoever sits
between you and the origin, the buyer finds out after paying, if at
all.
The x402 spec has an extension for exactly this: signed offers and
signed receipts. A JWS over the offer, Ed25519, with a key the seller
publishes. A buyer holds a commitment it can check before paying,
against a key anyone can fetch, without asking the seller. It is the
cheapest trust signal a seller can ship.
So I checked who ships it.
On 2026-08-03 I sent one GET to every host on the public x402
discovery list, 35 hosts, and read the 402 each one returned. The
checker is free and public, so the whole thing is reproducible by
anyone with curl:
curl -X POST https://scvd.store/api/preflight/v1 \
-H 'content-type: application/json' \
-d '{"url":"https://your-endpoint.example/api/thing"}'
The result:
I am not going to name the 34. The point is not who; it is that in
August 2026, a buyer paying an x402 endpoint on the public list was
paying against terms nobody had committed to, essentially everywhere.
What a signed offer costs to ship
Almost nothing. Two packages exist for it, zero dependencies, any
issuer:
x402-sign
mints spec-conformant signed offers and receipts for
your 402s and generates the did:web document your key lives at.x402-verify
checks anyone's, including mine.If you would rather not install anything, the conformance desk at
https://scvd.store/conformance takes a pasted offer or receipt from
any issuer and returns a structured verdict: parse, schema, signature
against the key its kid names, liveness. Free, no account, and it
checks a competitor's artifact exactly as readily as mine.
What I will do next
The census runs weekly now and the rows are published, signed, and
anchored into Bitcoin, at https://scvd.store/corpus. Every week's
round says how many hosts were reachable, how many were payable, and
how many served a signed offer, with the denominator beside every
number. If the 34 becomes 30 by October I will say so, and if it
becomes 35 I will say that too.
If you run an x402 endpoint: run the check above on your own door. It
takes one request. If it comes back with no signed offer, you are in
the 34, and the fix is an afternoon.
*Disclosure: the store in this piece is mine. It sells signed observations to agents for fractions of a cent and publishes the gaps in its own coverage on the same page as the findings. The census, the checker and the corpus are free along with any *