Recherche vérifiée par sources: X402 Agent Payment Verification

Verified source facts

1. x402 uses HTTP 402 payment requirements, a signed payment payload and a facilitator verification and settlement flow. 2. Coinbase documents distinct verification and settlement error reasons, including invalid signatures, insufficient funds, node failure and confirmation timeout. 3. The x402 extension set includes a Payment Identifier for duplicate-call handling and an Offer Receipt for signed pre-settlement terms. 4. A successful onchain settlement and successful resource delivery are separate events that require separate evidence.

Comparison at a glance

1. Control test: Requirements

A trading-control disclosure is meaningful only when converted into a testable rule. For requirements, inspect price, asset, network and recipient. Use a sandbox, non-production context, or the smallest reversible test available, then validate before signing. Capture configuration and event evidence without recording credentials, and verify the documented cancel, reject, decrement, or history behavior.

Model the failure path, not just the setup path. Ask which strategy owns the maker and taker orders, which account boundary the venue evaluates, which message reveals intervention, and how reconciliation behaves after a partial fill or disconnect. Platform documentation describes supported settings; it cannot prove that an operator configured them correctly. In this dimension, server mutation is therefore an explicit audit gap.

The requirements row should end with a concrete monitoring rule tied to price, asset, network and recipient. Make the operator validate before signing, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; server mutation remains a separate production risk until observed.

2. Control test: Authorization

For authorization, inspect signed payment payload. Use a sandbox, non-production context, or the smallest reversible test available, then bind the exact request.

In this dimension, replay is therefore an explicit audit gap.

The authorization row should end with a concrete monitoring rule tied to signed payment payload. Make the operator bind the exact request, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; replay remains a separate production risk until observed.

3. Control test: Identifier

For identifier, inspect one logical purchase. Use a sandbox, non-production context, or the smallest reversible test available, then persist a stable ID.

In this dimension, collision is therefore an explicit audit gap.

The identifier row should end with a concrete monitoring rule tied to one logical purchase. Make the operator persist a stable ID, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; collision remains a separate production risk until observed.

4. Control test: Verification

For verification, inspect signature and policy checks. Use a sandbox, non-production context, or the smallest reversible test available, then classify invalidReason.

In this dimension, policy drift is therefore an explicit audit gap.

The verification row should end with a concrete monitoring rule tied to signature and policy checks. Make the operator classify invalidReason, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; policy drift remains a separate production risk until observed.

5. Control test: Settlement

For settlement, inspect onchain transfer result. Use a sandbox, non-production context, or the smallest reversible test available, then store transaction evidence.

In this dimension, node timeout is therefore an explicit audit gap.

The settlement row should end with a concrete monitoring rule tied to onchain transfer result. Make the operator store transaction evidence, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; node timeout remains a separate production risk until observed.

6. Control test: Delivery

For delivery, inspect paid resource response. Use a sandbox, non-production context, or the smallest reversible test available, then record independent completion.

In this dimension, post-settlement failure is therefore an explicit audit gap.

The delivery row should end with a concrete monitoring rule tied to paid resource response. Make the operator record independent completion, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; post-settlement failure remains a separate production risk until observed.

7. Control test: Retry

For retry, inspect which phase may repeat. Use a sandbox, non-production context, or the smallest reversible test available, then use bounded phase-aware rules.

In this dimension, duplicate payment is therefore an explicit audit gap.

The retry row should end with a concrete monitoring rule tied to which phase may repeat. Make the operator use bounded phase-aware rules, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; duplicate payment remains a separate production risk until observed.

8. Control test: Receipt

For receipt, inspect terms and settlement confirmation. Use a sandbox, non-production context, or the smallest reversible test available, then retain signed proof.

In this dimension, format change is therefore an explicit audit gap.

The receipt row should end with a concrete monitoring rule tied to terms and settlement confirmation. Make the operator retain signed proof, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; format change remains a separate production risk until observed.

9. Control test: Network

For network, inspect CAIP-2 chain identity. Use a sandbox, non-production context, or the smallest reversible test available, then reject mismatches.

In this dimension, testnet confusion is therefore an explicit audit gap.

The network row should end with a concrete monitoring rule tied to CAIP-2 chain identity. Make the operator reject mismatches, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; testnet confusion remains a separate production risk until observed.

10. Control test: Reconciliation

For reconciliation, inspect payment, ledger and service output. Use a sandbox, non-production context, or the smallest reversible test available, then run periodic matching.

In this dimension, late finality is therefore an explicit audit gap.

The reconciliation row should end with a concrete monitoring rule tied to payment, ledger and service output. Make the operator run periodic matching, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; late finality remains a separate production risk until observed.

Decision scenarios

Scenario 1: when requirements becomes decisive

Consider a reader whose main constraint is price, asset, network and recipient. The correct response is not to infer a universal platform or product winner. It is to validate before signing, retain the evidence, and define a stop condition before funds or permissions are committed. If the evidence changes, the decision must be reopened. This produces a repeatable operating rule rather than a one-time opinion.

Scenario 2: when authorization becomes decisive

Consider a reader whose main constraint is signed payment payload. It is to bind the exact request, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 3: when identifier becomes decisive

Consider a reader whose main constraint is one logical purchase. It is to persist a stable ID, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 4: when verification becomes decisive

Consider a reader whose main constraint is signature and policy checks. It is to classify invalidReason, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 5: when settlement becomes decisive

Consider a reader whose main constraint is onchain transfer result. It is to store transaction evidence, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 6: when delivery becomes decisive

Consider a reader whose main constraint is paid resource response. It is to record independent completion, retain the evidence, and define a stop condition before funds or permissions are committed.

Sources and editorial method

• x402 overview — Coinbase Developer Platform
• x402 FAQ and extensions — Coinbase Developer Platform
• x402 troubleshooting — Coinbase Developer Platform
• HTTP 402 Payment Required — RFC Editor