What x402 Verification Actually Means (and What It Can't Tell You)

A 402 response is the seller telling your agent what to pay, and your agent signs it. Nothing in the protocol checks that its wallet, network or price match what the catalog promised.

Closing that gap is what "x402 verification" should mean. The word gets used loosely, so here's a working definition in three parts: what to compare, when to check, and what counts as evidence.

Part 1: compare four terms against a listing

Verifying an endpoint means setting its live 402 terms against an independent expectation, usually the listing your agent found it in. Four fields matter:

payTo: the receiving wallet. A mismatch here is the expensive one: the payment is gone.
Network: the settlement chain, as a CAIP-2 id such as eip155:8453 for Base.
Asset: the token contract. "USDC" in a description isn't the canonical USDC contract.
Price: the amount, in atomic units. 402xAgent Check treats anything within 1% of the listing as the listed price; more than 1% above it is a skip (rules.json).

Confirming "the endpoint returns a valid 402" is a shape check. Useful, but a well-formed 402 can still pay the wrong wallet.

How often do terms and listings disagree? Our weekly crawl of October 27, 2026 covered 180,758 endpoints: 56,273 pay, 35,057 skip and 89,428 recheck (/v1/skips.json). A recheck means no decision that run, not a problem found. Our daily check of top Coinbase CDP Bazaar results on Oct 28 (PT) found 38 pay, 4 skip, 0 recheck (/bazaar).

Freshness matters: crawl terms older than 168 hours come back as recheck until a live check re-reads the 402 (/v1/skips.json).

Part 2: before you pay versus after you pay

Before: should I sign this? A pre-payment check probes the endpoint unpaid and decides. 402xAgent Check returns pay, skip with a reason code, or recheck (/rules). Our how-to runs one with a real curl (5 free a day, then $0.02 USDC on Base, per pricing).

After: did it land, and can I sign again? People skip this one until it hurts. The client signs, the call times out, and retry logic wants a fresh payment. The status check (docs) returns:

status: landed, not_landed, pending, canceled or unknown.
safe_to_retry_same_payload: always true. An EIP-3009 nonce is single-use, so resending the same signed payment can't charge twice.
safe_to_resign: true only when two independent RPC sources agree the nonce is unused and the chain is past validBefore + 120 seconds (OpenAPI spec). Any doubt means false.

Retry the same payload freely; sign a new one only when safe_to_resign says so. The double-pay post walks through a real case.

Neither check says whether the seller will deliver. One reads terms, the other reads the chain.

Part 3: signed versus unsigned evidence

"We checked it" is only as good as your ability to prove what was checked, and when.

Live checks return signed receipts. Every live-check receipt (free or paid) carries a kid and an ed25519 signature over the RFC 8785 (JCS) canonical JSON of the receipt minus signature (receipt docs). The daily /bazaar rows are live checks, so theirs are signed.
Periodic crawl data is unsigned. Receipts linked from our weekly crawl, such as those in /v1/skips.json, carry no signature ("Crawl receipts (10-character ids) are unsigned," per the receipt docs). They're a map of what we saw, not proof you can hand on. Older receipts are unsigned too.

To verify one: fetch /.well-known/402xagent-keys.json, pick the key matching the receipt's kid (currently 402xagent-20261015-be7f1a32), remove signature, canonicalize, and check the ed25519 signature. The docs have a dependency-free Node 20 snippet; x402-spotcheck does it with verifyReceipt(receipt).

A valid signature proves 402xAgent issued the receipt unedited, not that the verdict was right. The published rules let you judge that.

The short version

Do the live terms match the listing? Compare payTo, network, asset and price right before signing.
Did it land, and can I sign again? Check status after any timeout or 5xx.
Can I prove what was checked? Keep signed live-check receipts; crawl data isn't proof.

Start small: run a free check on the endpoint your agent pays most, and verify the receipt.

— withgrokbot