Check an x402 payment request before you pay

Paste the PAYMENT-REQUIRED header of an HTTP 402 response. Settlens decodes it, validates it against the x402 V2 specification and your spending policy, and answers pay, review or do_not_pay with every check behind the answer.

Check a payment request Try the 60-second walkthrough

Free. No account, no wallet, no payment key.

In short

The Settlens x402 checker is a free browser tool: paste a PAYMENT-REQUIRED header (Base64 or JSON), the URL you requested and an optional spending policy. It validates the request with the official @x402/core 2.28.0 schema, checks the URL binding and each payment option, and answers pay, review or do_not_pay.

Three synthetic cases, about 60 seconds

Use the buttons in the checker below. Run each check explicitly; every decision comes from the public evaluator. No wallet or payment is involved.

0–20 seconds: select Load sample, then Check the request. Expected decision: pay under the complete example policy.
20–40 seconds: select Price doubles, then check again. The unchanged price ceiling rejects the new amount: do_not_pay.
40–60 seconds: select Recipient changes, then check again. The unchanged recipient allowlist rejects it: do_not_pay.

These are illustrative changes, not evidence of an attack or a customer incident. Watch the recorded example or reproduce all five cases with curl and CI.

Check a payment request

Load the sample to see a complete answer: the example request of the x402 V2 HTTP transport specification, under a policy that allows it. Each check links to its entry in the check catalog.

Try a payment change

Each button replaces the form with an illustrative request and spending policy. Then check the request to see the verdict. No payment is sent.

PAYMENT-REQUIRED header

The header value from the HTTP 402 response, as Base64, or the decoded JSON object.

URL you requested (recommended)

Must match resource.url exactly (a #fragment is ignored). Without it the answer is at most review. The checker never requests this URL.

Spending policy (optional)

A pay answer needs pay_to, assets, networks and max_amount. Separate several values with commas.

Allowed recipients (pay_to)

Addresses you agree to pay.

Allowed assets

Token contract addresses.

Allowed networks (CAIP-2)

For example eip155:8453 for Base.

Allowed schemes

For example exact.

Maximum amount (atomic units)

In the asset's smallest unit. USDC has 6 decimals: 10000 is 0.01 USDC.

This tool needs JavaScript in your browser. Without it, run the same check from an MCP client or a terminal: see use it from your agent.

Where to find the header

Request the paid URL without paying. An x402 V2 resource answers HTTP 402 with a PAYMENT-REQUIRED header: Base64 JSON listing the payment options it accepts. x402 V2 headers explains every field.

What happens to what you paste

Your browser sends it to the Settlens MCP endpoint, which runs the offline evaluate_payment_requirements tool in memory and keeps no copy of the content. Requests are limited to 60 per minute per IP address. Never paste a private key or seed phrase: the checker never needs one. Details in the privacy notice.

The decision, its reasons, the acceptable payment options and every check appear here.

What pay, review and do_not_pay mean

Fixed rules in the server decide, the same way on every call. No model judges whether the request looks safe.

do_not_pay: a check of high or critical severity failed, for example terms the official schema rejects, a resource.url that does not match your URL, or no payment option inside your policy. Never pay.
review: a non-blocking issue was found, the URL is missing, or the policy does not set pay_to, assets, networks and max_amount. Show the reasons to a person before paying.
pay: every protocol check passed and at least one option satisfies the complete policy. Pay only with an option listed as acceptable.

The policy applies to each advertised option, because a client pays with one of them. Writing one for an agent is covered in agent spending policies; the rules are specified in the MCP reference.

evaluate_payment_requirementsthe sample, four inputs

pay
The sample with its full policy
Every protocol check passed and at least one payment option is within the allowed recipients, assets, networks and maximum amount. Pay only with an option listed in acceptable.
review
The same policy without pay_to
The spending policy is incomplete: set allowed recipients (pay_to) to allow an automatic pay decision.
do_not_pay
With max_amount lowered to 5000
policy.acceptable_option: 0 of 1 payment option(s) satisfy the policy; 1 rejected (max_amount: 1).
do_not_pay
With resource_url set to another path
binding.resource_url: resource.url does not match the URL being assessed.

Real answers to the sample request, computed with the Settlens server code when this page was built.

The 13 offline checks

The checker runs the offline checks of a Settlens passive scan on the terms you paste. With the sample and its full policy, 13 checks run.

Checks run by the x402 checker
Check	What it verifies	Severity
`transport.payment_required_encoding`	PAYMENT-REQUIRED decodes as Base64 JSON	high
`schema.official_x402_sdk`	Official x402 SDK accepts PaymentRequired	high
`schema.payment_required`	PaymentRequired matches the x402 V2 core shape	high
`binding.resource_url`	Payment requirement is bound to the requested resource	high
`schema.payment_requirements`	Accepted payment requirements are well formed	high
`schema.duplicate_requirements`	Payment choices are unambiguous	low
`freshness.timeout_window`	Authorization windows are reasonably bounded	medium
`policy.scheme`	Schemes match the local policy	high
`policy.network`	Networks match the local policy	high
`policy.recipient`	Recipients match the local policy	high
`policy.asset`	Assets match the local policy	high
`policy.maximum_amount`	Amounts stay within the approved ceiling	high
`policy.acceptable_option`	At least one payment option satisfies the policy	high

transport.payment_required_encoding runs on a Base64 header, not on pasted JSON. Each policy.* check runs only for the constraints you set, except policy.acceptable_option, which runs whenever the header decodes. The passive and active checks need the live endpoint: see Assess.

What the checker does not check

The live endpoint. It reads what you paste and never requests the URL, so it cannot see the HTTP status, redirects, HTTPS or drift between responses. The passive scan does.
Chain state. No balances, settlement, or behavior of the token contract at asset.
x402 V1. A V1 payment request fails schema.payment_required and the answer is do_not_pay. See the V1 to V2 migration guide.
x402 over MCP. Payment requests carried over the MCP transport (mcp:// resources) are not evaluated: resource.url must be an http(s) URL, so the answer is do_not_pay.
Payment flow semantics. extra.paymentFlow and extra.assetTransferMethod are not interpreted.
Decimals across assets. max_amount is compared in each option's atomic units, so list only assets with the same decimals.
The signature. A captured PAYMENT-SIGNATURE is checked by the EIP-3009 signature verifier.

Use it from your agent or a terminal

The checker is a page in front of a public MCP tool. An agent can call the same tool on every HTTP 402 before it pays.

Add the remote endpoint to Claude Code (any MCP client with Streamable HTTP works):

ShellClaude Code

claude mcp add --transport http settlens https://settlens.com/mcp

Or call the tool directly with the sample header:

Shellcurl

curl -s https://settlens.com/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"evaluate_payment_requirements","arguments":{"payment_required":"eyJ4NDAyVmVyc2lvbiI6MiwiZXJyb3IiOiJQQVlNRU5ULVNJR05BVFVSRSBoZWFkZXIgaXMgcmVxdWlyZWQiLCJyZXNvdXJjZSI6eyJ1cmwiOiJodHRwczovL2FwaS5leGFtcGxlLmNvbS9wcmVtaXVtLWRhdGEiLCJkZXNjcmlwdGlvbiI6IkFjY2VzcyB0byBwcmVtaXVtIG1hcmtldCBkYXRhIiwibWltZVR5cGUiOiJhcHBsaWNhdGlvbi9qc29uIn0sImFjY2VwdHMiOlt7InNjaGVtZSI6ImV4YWN0IiwibmV0d29yayI6ImVpcDE1NTo4NDUzMiIsImFtb3VudCI6IjEwMDAwIiwiYXNzZXQiOiIweDAzNkNiRDUzODQyYzU0MjY2MzRlNzkyOTU0MWVDMjMxOGYzZENGN2UiLCJwYXlUbyI6IjB4MjA5NjkzQmM2YWZjMEM1MzI4YkEzNkZhRjAzQzUxNEVGMzEyMjg3QyIsIm1heFRpbWVvdXRTZWNvbmRzIjo2MCwiZXh0cmEiOnsibmFtZSI6IlVTREMiLCJ2ZXJzaW9uIjoiMiJ9fV19","resource_url":"https://api.example.com/premium-data","policy":{"pay_to":["0x209693Bc6afc0C5328bA36FaF03C514EF312287C"],"assets":["0x036CbD53842c5426634e7929541eC2318f3dCF7e"],"networks":["eip155:84532"],"max_amount":"10000","schemes":["exact"]}}}}'

Questions about the x402 checker

Is the x402 checker free?

Yes. It needs no account, wallet or payment key. Requests to the Settlens MCP endpoint, which the checker calls, are limited to 60 per minute per IP address.

Does the checker pay, sign or contact the paid resource?

No. It reads only what you paste. It never pays, signs or calls a facilitator, and it does not request the URL you enter: it only compares that URL with resource.url.

Why do I get review instead of pay?

A pay answer needs every protocol check to pass, the URL you requested, and a policy that sets pay_to, assets, networks and max_amount. When one is missing the answer is review, and the reasons say what is missing.

Does it support x402 V1?

No. It checks x402 V2 payment requests. A V1 request fails the V2 schema check and the answer is do_not_pay. The migration guide lists what changed.

Sources

x402 Protocol Specification, version 2x402 Foundation · github.com
x402 V2 HTTP transportx402 Foundation · github.com
CAIP-2: Blockchain ID SpecificationChain Agnostic Standards Alliance · github.com
Model Context Protocol specification (2025-06-18): toolsModel Context Protocol · modelcontextprotocol.io

Check the endpoint, not only its terms

A pilot assesses one paid endpoint or facilitator: passive scan, CI gate, monitoring and signed evidence your partners can verify.

Request a pilot See how Assess works