x402 and agentic payment security
Practical writing on testing agentic payments: the failure modes that matter, how to check them without holding a payment key, and how to turn results into evidence other people can verify.
7 articles, newest first.
In short
The Settlens blog covers x402 and agentic payment security in technical detail: the failure modes to test, a step-by-step endpoint testing checklist, payment drift detection, preflight checks before an AI agent pays, and signed evidence that auditors verify offline.
All articles
-
Test x402 payment terms before a release
Reproduce five x402 V2 payment-policy checks with a free browser demo, curl and a small Node.js CI example. No account, wallet or payment key needed.
-
Detecting x402 payment drift: price, recipient, network and asset changes
How to catch x402 payment terms that change between identical requests or over time, with the Settlens stability check, policy pins and Monitor baselines.
-
Verify before paying: a preflight check for AI agents on x402
Why AI agents need a deterministic check before signing an x402 payment, how to write a spending policy in atomic units, and a worked example with real output.
-
Signed evidence for payment assessments: digests, ed25519 and offline verification
Why a payment security report needs an integrity digest and a signature, how Settlens signs reports with ed25519, and how auditors verify them offline.
-
Agentic payments are moving real money. Here's what breaks.
When AI agents pay APIs over x402, no human checks the price, recipient or chain. Where agentic payments break, and what agents and sellers should verify.
-
How to test an x402 payment endpoint: a practical checklist
A step-by-step guide to testing an x402 V2 endpoint: passive scan, policy, facilitator checks, the authorized fail-closed probe, offline verification and CI.
-
x402 security: the payment failure modes every implementation should test
Eight ways x402 payment endpoints fail quietly, from fail-open resources and forged signatures at /verify to drift and weak binding, and how to test each one.
New to x402?
Start with the protocol, then come back to the articles.
-
What is x402?
How HTTP 402, the PAYMENT-REQUIRED challenge and a facilitator fit together.
-
x402 V1 to V2 migration
What changed on the wire between the two protocol versions, header by header.
-
x402 security checklist
The properties a paid endpoint and its facilitator should satisfy before agents pay them.
-
x402 payment request checker
Paste a PAYMENT-REQUIRED header and check it against a spending policy from your browser.
See these checks on your own endpoints
A scoped pilot assesses one paid endpoint or facilitator and delivers a report your partners can verify offline.