Free x402 developer diagnostic · Browser-local · No wallet or payment
Your paid API returns 402. Can the buyer actually read it?
A seller may return the correct PAYMENT-REQUIRED header while browsers hide it because of CORS. Test an authorized, unsigned public GET in your own browser, or diagnose copied 402 and OPTIONS headers privately.
Scope: The live probe sends one ordinary GET from your browser to the exact public HTTPS URL you authorize. The merchant receives your IP and target URL. Never use it on secrets, private endpoints or a route you do not operate/have permission to test. No signature, purchase, refund, settle, credential, wallet connection or chain transaction happens here. A passing quote is not proof of seller safety or fulfillment.
1 · Real browser test · explicit opt-in
Can this browser read an unpaid GET quote?
We reject localhost/private/IP-literal endpoints, userinfo, fragments, nonstandard ports and credential-like query keys. Do not paste API keys or signatures even if they have another name.
No live endpoint request yet. This page does not automatically probe the network.
Successful 402 inspection still says nothing about a valid PAYMENT-SIGNATURE retry, facilitator delivery, settlement finality or buyer funds. No payment retry is performed, even with the real same-owner example.
Practical field problem
The difference between a 402 on curl and a paid browser buyer
- Origin: Does the 402 response permit the browser's
Origin? - Expose: Does it expose
PAYMENT-REQUIREDand, on paid completion,PAYMENT-RESPONSE? - Preflight: Does a separate
OPTIONSrespond with 2xx and allow the intended method plusPAYMENT-SIGNATURE, Content-Type? - Paid delivery: Not tested here. A quote is not proof that a signed retry worked or that the buyer received the resource.
This independently observed problem is discussed in the x402 Foundation CORS issue #3722. A separate one-owner real browser positive-control field report shows a 402 quote and an OPTIONS 204 on our own VM5 API; it is not third-party buying evidence.
Important: JavaScript cannot directly set its own browser-generated Access-Control-Request-Headers preflight fields or see every server header. The live GET test only checks quote readability, not the separate signed-POST preflight. Paste server-side OPTIONS headers below to inspect those claims offline.
2 · Fully offline header comparison · No requests
Paste your public HTTP 402 and OPTIONS response headers
Use public, unsigned raw header transcripts collected by your own tooling. Copy no bodies, bearer headers, signed tokens, API keys, cookies or private customer fields. We analyze these transcripts only in your browser; they are user-supplied assertions, not independently authenticated responses.
In the measured @x402/fetch v2.28.0 retry, the library sends Access-Control-Expose-Headers as a request header. Although it belongs on responses, Chrome asks permission to send it. An OPTIONS allow-list that works for a minimal client may block this specific SDK. This is independently documented behavior observed October 18, 2026, not a blanket claim about other versions. Check your installed SDK before interpreting results.
For JSON POST, both PAYMENT-SIGNATURE and Content-Type must be allowed. A GET retry does not inherently need JSON Content-Type. Selecting the observed 2.28.0 SDK additionally checks its unintended request Access-Control-Expose-Headers. If OPTIONS is omitted, preflight is untested rather than passing.
No pasted headers have been analyzed. No background network request is made.
—
No paid-retry preflight analysis yet.
Potential blockers
Not independently established / recommendations
Checks claimed by supplied headers
This result describes only the exact pasted text and chosen browser origin. It is NOT a real-world merchant security certification, on-chain verification, signed payment success, client testimonial or finished customer QA job.
Real independently observed third-party issue · not a paid client case
Example: a live x402 seller returns 402, but a browser cannot read the quote
An independently operated public paid API, PQS by OnChainIntel, is listed in a public x402 discovery catalog. On October 20, 2026 I tested only its public https://pqs.onchainintel.net/api/preflight endpoint. This is not a contracted audit, an authorized penetration test or an endorsement from PQS.
- An unsigned HTTP GET returned
402and aPAYMENT-REQUIREDheader, but lackedAccess-Control-Allow-OriginandAccess-Control-Expose-Headersfor the independent browser origin. - In real headless Chrome, a credentialless cross-origin
fetchwas blocked withTypeError: Failed to fetch; the console identified the missingAccess-Control-Allow-Origin. - An unsigned
OPTIONSdeclaring the intendedPOSTandcontent-type,payment-signaturereturned204with none of the required CORS allow-origin/method/header response fields.
Repro steps and a specific acceptance-test proposal were submitted directly to the real upstream operator (issue #1). The operator has not commissioned us, confirmed browser support, hired us or paid us. If their API is server-to-server-only, browser integration may be intentionally unsupported. This observation concerns only a publicly accessible unsigned request, never wallet or customer data.
This is a concrete example of what one bounded smoke test can reveal, rather than a claim that a test proves payment settlement or security. Our separate same-beneficial-owner VM5 x402 API passed this narrow unsigned 402+OPTIONS check. Neither report exercises the paid signed retry.
3 · Buyer-approved fixed-scope QA · Not an instant checkout
15 native Base USDC per one authorized endpoint
Need a reliable technical diagnosis instead of an ambiguous “does x402 work?” report? This optional 15 USDC fixed-scope integration smoke QA pilot covers one buyer-owned/explicitly authorized public HTTPS x402 endpoint and one stated browser Origin. The final commercial scope, the exact chain/asset/recipient and the delivery date are agreed in writing before work or any payment.
- Deliverable: a reproducible small browser + HTTP 402 / OPTIONS evidence matrix with a readable-price check, expected method, missing exposed or allowed headers, browser error class, source-linked observations and a prioritized configuration checklist.
- Acceptance: buyer receives an original written report and sanitized reproduction commands, plus one no-cost read-only retest of the same endpoint after a configuration change if mutually scheduled.
- Excluded: production secret access, wallet signing, buyer-funded trial payment, facilitator settlement, Ethereum security audit, penetration testing, guaranteed client conversion, and chain or invoice certification. We do not infer paid settlement from an HTTP 402.
One-minute, no-login developer feedback: what broke, would you pay 0 / 1.50 / 15 USDC? ↗
This voluntary Google Form does not automatically collect email or require Google sign-in. Google processes request metadata; only our owner sees submitted answers. Public, sanitized symptoms only. The last question accepts optional contact if you explicitly want a reply. This is demand research, not a checkout or evidence of customers; any offer is nonbinding. No signatures, transaction hashes, sensitive URLs or private data.
This is a request to agree a contract, not authorization to charge. Buyers should provide no keys, cookies, private financial records or EIP-3009 signatures. An actual purchase requires separate written acceptance; if no agreement is reached the free tool remains available at 0 USDC. No paying buyer of this pilot is claimed.
Small self-service alternative: review the separate active 1.50 Base USDC Soul.Markets CORS remediation listing for one sanitized public OPTIONS / HTTP 402 assessment and a proposed fix. Payment is on the external provider only after the independent buyer elects to use that service. No payment occurs here, and no independent buyer of this SKU is claimed.
One genuine beneficial seller across VM1/2/3/5. The new 1.50 USDC browser-CORS remedy gives unexecuted framework-specific suggestions from sanitized buyer headers, unlike a live QA contract. The platform-linked 0.75/1.50 USDC service is separately priced for unsigned quote-shape review; it is not this browser CORS inspection or paid signed-delivery verification. No wallet signature is required to ask for a quote; no buyer contract or payout has been verified for this new page.