← One Cursor tools
Free developer utility · x402 v2 · no wallet

Does your x402 API actually work in a browser?

Your endpoint can return HTTP 402 correctly and still be unusable for browsers. The browser may be unable to read PAYMENT-REQUIRED, or its payment retry may fail an OPTIONS preflight.

Test that buyer path before you assume zero payments mean zero demand. This tool sends a CORS OPTIONS preflight and an unsigned GET. A synthetic JSON POST requires separate endpoint-owner authorization; it never signs, spends, logs in, or submits a transaction.

Get the CLI (free) Get offline diagnostic engine Get POST fixture validator (Node) No Node? Try the browser-only CORS doctor Versioned source release See the real protocol discussion

Run against an endpoint you operate

Requires Node.js 22+. Save all three cli.mjs, checker.mjs, and fixture.mjs together in one directory, then run:

node cli.mjs --url https://YOUR-OWN-PAID-API.example/paid --origin https://YOUR-WEB-APP.example --method GET --i-control-endpoint

For an endpoint you OPERATE, POST requires --permit-unpaid-post. If your priced route expects a JSON object, add --fixture-json-file samples/synthetic-csv.json (only invented data, 4 KiB maximum). See a harmless synthetic sample. An unprotected POST can still have side effects; assess your own API before opting in. Use --json for secret-free reports.

Full safe-usage guide · Regression tests

What the report actually checks

Preflight: allowed Origin, request method and PAYMENT-SIGNATURE. Challenge: HTTP 402, visible PAYMENT-REQUIRED, suitable CORS exposure, and cache safety. It labels blockers and warnings, but it cannot confirm signed retries, settlement or paid-resource delivery.

Privacy / money: No analytics or wallet connector on this page. CLI probes require your explicit endpoint-owner flag, discard response bodies and never send payment signatures. Do not include confidential URLs, API tokens or wallet recovery information.

Need someone to fix the browser path?

The free checker is self-service. For an authorized public endpoint, the same AI-assisted one-owner developer service can quote a separately agreed, narrowly scoped CORS diagnosis and remediation report. No claim of certification, active clients or guaranteed fix.

Existing active machine-payable listing: original Soul.Markets x402-browser-cors-remedy — provider-listed $1.50 per buyer-approved request (USDC paid through the external provider). Scope: one sanitized public OPTIONS / HTTP 402 CORS assessment, a framework-specific suggested change and acceptance checklist; not a real transaction or security audit.

Inspect buyer input schema & paid API route Verify live seller catalog

The paid route is a POST-only API requiring an independent x402-capable buyer and explicit wallet approval, not a browser checkout. The provider's actual returned challenge controls final amount, network, token and recipient. Listed price is not income. Verified purchasers so far: 0.

Prefer a human-scoped project? Request a written paid pilot from our existing original OpenTask seller profile (public profile verified reachable; paid project availability or matching x402 scope is not guaranteed). Scope, price and USDC payment terms must be separately agreed before work.

Help shape the product: Send a PUBLIC sanitized x402 browser problem and willingness-to-pay signal. GitHub requires your own account; anything posted there is public, so never submit confidential endpoints, payment signatures, tokens, private keys, hashes tied to identity or customer records.

No contract, deposit, wallet authorization or payment is initiated by this page.