--- name: x402-testing description: Test and debug x402 (HTTP 402) payment code. Use when building or debugging an x402 client, agent wallet, or paid endpoint; when a payment fails with an x402 error code; or when asked whether an endpoint can be paid by an agent. Provides public test endpoints, an endpoint checker, an error reference and a header decoder at https://x402testendpoint.com. --- # x402 testing https://x402testendpoint.com is a free, public service with no account or API key. By default everything uses test USDC on Base Sepolia (eip155:84532), and every scenario also runs on Solana Devnet with `?network=solana-devnet`. Nothing costs real money unless you explicitly ask for a mainnet (`?network=base` or `?network=solana`) or call the paid audit described at the end. Do neither without the user's approval. ## Testing a buyer: a client, SDK integration or agent wallet 1. Start with the baseline: `GET https://x402testendpoint.com/t/ok`. It answers 402 with an x402 version 2 quote in the `PAYMENT-REQUIRED` header. The client should pay by retrying with a `PAYMENT-SIGNATURE` header and receive 200 with `x-test-verdict: pass`. The wallet needs test USDC from https://faucet.circle.com. 2. Then run the traps. Each is a seller behaving badly, and a correct client must NOT pay: - `/t/overpriced`: quotes $1,000. The client's spending cap should refuse. - `/t/price-bump`: answers the paid retry with a new quote for $5. The client should not follow the price up. - `/t/wrong-network`: only offers a network no wallet supports. - `/t/malformed`: the quote header is not base64 JSON. - `/t/missing-fields`: the quote has no recipient or asset. - `/t/always-402`: never delivers. The client must stop retrying. 3. Also run `/t/choose` (two options, first unsupported; pay the second) and `/t/slow` (5 second delays; do not time out or pay twice). If the client supports usage-based billing, run `/t/upto` (Base Sepolia only): it quotes the `upto` scheme for a maximum of $0.05 and settles $0.01. The client must register the upto scheme, and the wallet needs a one-time Permit2 approval. 4. Read the verdict: a payment sent to a trap returns HTTP 400 with `x-test-verdict: fail` and a `reason`. Trap payments are never settled, stored or logged. Write the traps into the project's test suite as assertions that the client throws or returns an error before sending a payment. The full list with expected behaviour is at `https://x402testendpoint.com/scenarios.json`; each scenario has a page at `https://x402testendpoint.com/scenarios/.md`. ## Testing a seller: an endpoint that charges - `GET https://x402testendpoint.com/api/check?url=` fetches the endpoint once without paying and returns JSON: a `verdict` (payable, broken-402, no-payment-required, redirect, unreachable), the protocols detected, prices, and `findings` with levels pass, warn, fail, info. Fix every `fail`. - The endpoint must be publicly reachable. For a local server, deploy a preview or use a tunnel first. - The expected response format is documented at `https://x402testendpoint.com/reference/payment-required.md`. ## Debugging a failed payment - Look up any x402 error code or client message: `GET https://x402testendpoint.com/api/errors?q=`. It returns the cause and the fix, and says whether the buyer or the seller usually has to change something. - Decode a header value: `GET https://x402testendpoint.com/api/decode?value=`. Never send a live `PAYMENT-SIGNATURE` value to any third party, this service included: it is spendable until it expires. Decode those locally with base64 and JSON. - A common cause of `invalid_exact_evm_signature`: USDC's EIP-712 name is "USD Coin" on Base mainnet and "USDC" on Base Sepolia. Sign with the `name` and `version` from the quote's `extra`. ## MCP The same tools are available as an MCP server (Streamable HTTP, no auth) at `https://x402testendpoint.com/mcp`: `check_endpoint`, `list_scenarios`, `explain_error`, `decode_header`. ## Paid audit (optional) `GET https://x402testendpoint.com/api/audit?url=` is itself sold over x402 for $0.02. It adds on-chain checks of the token contract (catching name, version and wrong-network mistakes before buyers hit them), facilitator support, and quote stability. Its 402 quote states the network and price; only pay it if the user has approved spending. The free check is usually enough to start.