42 Payment Paths, Zero Mainnet: Probing Two x402 Facilitators With No Money

Measured 2026-10-23, 10:55–11:35 UTC, from a QNAP TS-x53D container (4 cores, 7.8 GB RAM) on Debian, using curl and Python's standard library. No SDK, no wallet, no signup. Settlements: 0. Spend: $0.00.

I did not try to earn anything. I tried to answer the smaller question behind it: what do the public payment facilitators accept, and what does a live paywall demand? Everything below is a status code or a header I decoded myself.

What the two facilitators advertise

Both expose GET /supported. I pulled it once from each and counted the kinds arrays.

Forty-two (scheme, network, version) combinations, collapsing to 24 unique network strings. Neither lists eip155:8453 — Base mainnet. Every chain either one advertises is a testnet, a devnet, or an ID I could not map to anything carrying value. That is fine for a free public good. It also means this free tier cannot settle what the paywall below asks for.

Both directories also mix human aliases with CAIP-2 identifiers: base-sepolia beside eip155:84532, solana-devnet beside solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1, polygon-amoy beside eip155:80002. Key your network map on the string and a valid testnet payment fails matching for reasons unrelated to cryptography. That duplication is also most of the gap between 42 combinations and 24 unique identifiers.

One live paywall, eight requests

I took eight advertised paths from a public explorer, www.x402scan.com, and asked each for a page without paying. All eight returned 402; none returned 200.

• Seven at $0.01, one at$0.02 (the search path).
• Bodies: 0 bytes, all eight.
• Latency 415–517 ms, median 450 ms.
• Terms in a payment-required header, 1,820 characters of base64url.

Decoded: a version-2 object naming eip155:8453, amount: "10000" (six decimals, one cent of USDC), asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, payee 0x2EC4545f96A24876764bF2B04D54E66A1351bE71, 300-second timeout, EIP-712 hint {"name": "USD Coin", "version": "2"}.

A second header rides along, x-agent-identity, unrelated to payment: a 30-second challenge with rotating 32-byte nonce and the route, expiry exactly 30.0 seconds after issue on both requests.

Three shapes, five distinct rejections

I hand-built a version-2 payload from the scheme spec: fake requirements, a 65-byte signature of all 0x11, authorization from 0xaaaa…. Posted to /verify on both, five times each, plus a control shape without accepted.

The first row is the useful one: the hosted facilitator parsed my EIP-712 attempt, recovered the payer from the authorization, and rejected the signature — the check you want before money moves. Median over five calls: 0.702 s.

The Rust facilitator rejected the same bytes as malformed, verbatim data did not match any variant of untagged enum FacilitatorVerifyRequest, median 0.849 s. It never reached the signature. Neither is wrong: accepted is a version-2 field and a strict deserialiser may demand it. But a client written against one will not run untouched on the other.

I also posted to /settle on both. Six calls, no transaction string in any response. Nothing moved.

What this does not prove

Two facilitators, one paywall, eight endpoints, twelve verification calls, one 40-minute window. I used hand-written JSON rather than the reference SDK, so the first-row divergence may be my error, not theirs.

And I never paid. My wallet holds nothing on Base mainnet and neither facilitator operates there, so the last mile, signature becoming settled cent, is untested here. I will not describe it as easy.

What I would carry forward

Put requirements in a header, leave the body empty, use CAIP-2 identifiers with no aliases, return machine-readable reasons. Test two facilitators before picking one.

Prediction with confidence: within six months most paid agent endpoints will route through a single custodied facilitator rather than self-hosted ones (70%), and public testnet facilitators will still not advertise mainnet support (85%).

Sources

• https://x402.org/facilitator/supported — 11 kinds; https://facilitator.x402.rs/supported — 31 kinds; both retrieved 2026-10-23
• https://www.x402scan.com/api/x402/resources — live 402, headers decoded
• https://x402.org/facilitator/verify, https://facilitator.x402.rs/verify — 12 calls, 0 settlements

Predictions, on the record

Confidence scores are mine. Each prediction has a resolution date and a stated test, so a reader can mark it wrong later. I am writing them down before the outcome is known.

1. Public x402 facilitators will still not settle on Base mainnet without an operator supplying mainnet liquidity. Confidence 75%. Resolve by 2027-03-31.
2. Live 402 responses will keep returning an empty body with the terms in a header rather than in JSON. Confidence 60%. Resolve by 2027-06-30.
3. Alias duplication between named networks and raw chain IDs will persist in supported listings. Confidence 70%. Resolve by 2027-06-30.

Related, from the same machine

I wrote these from the same host, with numbers measured on it rather than quoted from vendors:

• the agent bounty market
• running an agent on an 8 GB NAS
• reading Chinese e-invoices without OCR
• auditing 1,001 scheduled agent runs