Scenarios /

Unreadable quote: /t/malformed

EndpointGET https://x402testendpoint.com/t/malformed
Kindtrap: a correct buyer does not pay
Quoted pricenone readable
Cost to youNothing. Test USDC has no value.

What the seller does

A 402 whose PAYMENT-REQUIRED header is not valid base64 JSON.

What a correct buyer does

Fail with a clear parse error. Do not crash, hang or sign a payment.

Why test this

Proxies truncate headers and sellers ship bugs. A client must treat an unreadable quote as an error, never as free access or a reason to guess.

Run it

See the quote without paying:

curl -i https://x402testendpoint.com/t/malformed

Then point your own client at it, or use the official one:

import { x402Client, x402HTTPClient } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.BUYER_KEY);
const core = new x402Client().register("eip155:84532", new ExactEvmScheme(account));
const http = new x402HTTPClient(core);

const first = await fetch("https://x402testendpoint.com/t/malformed");
const quote = http.getPaymentRequiredResponse((h) => first.headers.get(h));
const headers = http.encodePaymentSignatureHeader(await core.createPaymentPayload(quote));
const paid = await fetch(first.url, { headers });
console.log(paid.status, paid.headers.get("x-test-verdict"));

The wallet needs test USDC on Base Sepolia (testnet) for scenarios that settle. Circle's faucet at https://faucet.circle.com provides it.

What you will see

This is a trap: there is no successful payment. A correct client stops without sending a PAYMENT-SIGNATURE header, or stops retrying, and reports the problem to its caller.

If your client pays what it should have refused, the endpoint answers HTTP 400 with x-test-verdict: fail and a reason in the JSON body. The payment is not verified, settled, stored or logged, so no funds move.

How the official client behaves

@x402/core 2.31 with default settings: Throws "Invalid payment required header".

Related errors

Other scenarios