--- title: "x402 payment request checker (free, no wallet) | Settlens" description: "Free x402 checker: paste a PAYMENT-REQUIRED header and your spending policy to get pay, review or do_not_pay with every check. No wallet, no sign-up." url: https://settlens.com/tools/x402-checker last_updated: 2026-10-15 --- # Check an x402 payment request before you pay > **In short:** The Settlens x402 checker is a free browser tool: paste a PAYMENT-REQUIRED header (Base64 or JSON), the URL you requested and an optional spending policy. It validates the request with the official @x402/core 2.28.0 schema, checks the URL binding and each payment option, and answers pay, review or do_not_pay. Paste the PAYMENT-REQUIRED header of an HTTP 402 response. Settlens decodes it, validates it against the x402 V2 specification and your spending policy, and answers pay, review or do_not_pay with every check behind the answer. [Check a payment request](https://settlens.com/tools/x402-checker#checker) [Try the 60-second walkthrough](https://settlens.com/tools/x402-checker#guided-demo) Free. No account, no wallet, no payment key. ## Three synthetic cases, about 60 seconds Use the buttons in the checker below. Run each check explicitly; every decision comes from the public evaluator. No wallet or payment is involved. 1. **0–20 seconds:** select **Load sample**, then **Check the request**. Expected decision: `pay` under the complete example policy. 2. **20–40 seconds:** select **Price doubles**, then check again. The unchanged price ceiling rejects the new amount: `do_not_pay`. 3. **40–60 seconds:** select **Recipient changes**, then check again. The unchanged recipient allowlist rejects it: `do_not_pay`. These are illustrative changes, not evidence of an attack or a customer incident. [Watch the recorded example](https://settlens.com/blog/check-x402-payment-policy#video) or [reproduce all five cases with curl and CI](https://settlens.com/blog/check-x402-payment-policy#ci). ## Check a payment request Load the sample to see a complete answer: the example request of the x402 V2 HTTP transport specification, under a policy that allows it. Each check links to its entry in the [check catalog](https://settlens.com/docs/checks). ### Where to find the header Request the paid URL without paying. An x402 V2 resource answers HTTP 402 with a `PAYMENT-REQUIRED` header: Base64 JSON listing the payment options it accepts. [x402 V2 headers](https://settlens.com/learn/x402-v2-headers) explains every field. ### What happens to what you paste Your browser sends it to the Settlens MCP endpoint, which runs the offline `evaluate_payment_requirements` tool in memory and keeps no copy of the content. Requests are limited to 60 per minute per IP address. Never paste a private key or seed phrase: the checker never needs one. Details in the [privacy notice](https://settlens.com/privacy#mcp-endpoint). The decision, its reasons, the acceptable payment options and every check appear here. ## What pay, review and do_not_pay mean Fixed rules in the server decide, the same way on every call. No model judges whether the request looks safe. - `do_not_pay`: a check of high or critical severity failed, for example terms the official schema rejects, a `resource.url` that does not match your URL, or no payment option inside your policy. Never pay. - `review`: a non-blocking issue was found, the URL is missing, or the policy does not set `pay_to`, `assets`, `networks` and `max_amount`. Show the reasons to a person before paying. - `pay`: every protocol check passed and at least one option satisfies the complete policy. Pay only with an option listed as acceptable. The policy applies to each advertised option, because a client pays with one of them. Writing one for an agent is covered in [agent spending policies](https://settlens.com/learn/agent-spending-policy); the rules are specified in the [MCP reference](https://settlens.com/docs/mcp#decision-rules). evaluate\_payment\_requirements the sample, four inputs - pay The sample with its full policy Every protocol check passed and at least one payment option is within the allowed recipients, assets, networks and maximum amount. Pay only with an option listed in acceptable. - review The same policy without pay_to The spending policy is incomplete: set allowed recipients (pay_to) to allow an automatic pay decision. - do_not_pay With max_amount lowered to 5000 policy.acceptable_option: 0 of 1 payment option(s) satisfy the policy; 1 rejected (max_amount: 1). - do_not_pay With resource_url set to another path binding.resource_url: resource.url does not match the URL being assessed. _Real answers to the sample request, computed with the Settlens server code when this page was built._ ## The 13 offline checks The checker runs the offline checks of a Settlens passive scan on the terms you paste. With the sample and its full policy, 13 checks run. _Checks run by the x402 checker_ | Check | What it verifies | Severity | | --- | --- | --- | | [`transport.payment_required_encoding`](https://settlens.com/docs/checks#transport.payment_required_encoding) | PAYMENT-REQUIRED decodes as Base64 JSON | high | | [`schema.official_x402_sdk`](https://settlens.com/docs/checks#schema.official_x402_sdk) | Official x402 SDK accepts PaymentRequired | high | | [`schema.payment_required`](https://settlens.com/docs/checks#schema.payment_required) | PaymentRequired matches the x402 V2 core shape | high | | [`binding.resource_url`](https://settlens.com/docs/checks#binding.resource_url) | Payment requirement is bound to the requested resource | high | | [`schema.payment_requirements`](https://settlens.com/docs/checks#schema.payment_requirements) | Accepted payment requirements are well formed | high | | [`schema.duplicate_requirements`](https://settlens.com/docs/checks#schema.duplicate_requirements) | Payment choices are unambiguous | low | | [`freshness.timeout_window`](https://settlens.com/docs/checks#freshness.timeout_window) | Authorization windows are reasonably bounded | medium | | [`policy.scheme`](https://settlens.com/docs/checks#policy.scheme) | Schemes match the local policy | high | | [`policy.network`](https://settlens.com/docs/checks#policy.network) | Networks match the local policy | high | | [`policy.recipient`](https://settlens.com/docs/checks#policy.recipient) | Recipients match the local policy | high | | [`policy.asset`](https://settlens.com/docs/checks#policy.asset) | Assets match the local policy | high | | [`policy.maximum_amount`](https://settlens.com/docs/checks#policy.maximum_amount) | Amounts stay within the approved ceiling | high | | [`policy.acceptable_option`](https://settlens.com/docs/checks#policy.acceptable_option) | At least one payment option satisfies the policy | high | `transport.payment_required_encoding` runs on a Base64 header, not on pasted JSON. Each `policy.*` check runs only for the constraints you set, except `policy.acceptable_option`, which runs whenever the header decodes. The passive and active checks need the live endpoint: see [Assess](https://settlens.com/product/assess). ## What the checker does not check - **The live endpoint.** It reads what you paste and never requests the URL, so it cannot see the HTTP status, redirects, HTTPS or drift between responses. The [passive scan](https://settlens.com/product/assess) does. - **Chain state.** No balances, settlement, or behavior of the token contract at `asset`. - **x402 V1.** A V1 payment request fails `schema.payment_required` and the answer is `do_not_pay`. See the [V1 to V2 migration guide](https://settlens.com/learn/x402-v1-to-v2-migration). - **x402 over MCP.** Payment requests carried over the MCP transport (`mcp://` resources) are not evaluated: `resource.url` must be an http(s) URL, so the answer is `do_not_pay`. - **Payment flow semantics.** `extra.paymentFlow` and `extra.assetTransferMethod` are not interpreted. - **Decimals across assets.** `max_amount` is compared in each option's atomic units, so list only assets with the same decimals. - **The signature.** A captured `PAYMENT-SIGNATURE` is checked by the [EIP-3009 signature verifier](https://settlens.com/tools/eip-3009-verifier). ## Use it from your agent or a terminal The checker is a page in front of a public MCP tool. An agent can call the same tool on every HTTP 402 before it pays. Add the remote endpoint to Claude Code (any MCP client with Streamable HTTP works): **Claude Code** ```shell claude mcp add --transport http settlens https://settlens.com/mcp ``` Or call the tool directly with the sample header: **curl** ```shell curl -s https://settlens.com/mcp \ -H 'content-type: application/json' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"evaluate_payment_requirements","arguments":{"payment_required":"eyJ4NDAyVmVyc2lvbiI6MiwiZXJyb3IiOiJQQVlNRU5ULVNJR05BVFVSRSBoZWFkZXIgaXMgcmVxdWlyZWQiLCJyZXNvdXJjZSI6eyJ1cmwiOiJodHRwczovL2FwaS5leGFtcGxlLmNvbS9wcmVtaXVtLWRhdGEiLCJkZXNjcmlwdGlvbiI6IkFjY2VzcyB0byBwcmVtaXVtIG1hcmtldCBkYXRhIiwibWltZVR5cGUiOiJhcHBsaWNhdGlvbi9qc29uIn0sImFjY2VwdHMiOlt7InNjaGVtZSI6ImV4YWN0IiwibmV0d29yayI6ImVpcDE1NTo4NDUzMiIsImFtb3VudCI6IjEwMDAwIiwiYXNzZXQiOiIweDAzNkNiRDUzODQyYzU0MjY2MzRlNzkyOTU0MWVDMjMxOGYzZENGN2UiLCJwYXlUbyI6IjB4MjA5NjkzQmM2YWZjMEM1MzI4YkEzNkZhRjAzQzUxNEVGMzEyMjg3QyIsIm1heFRpbWVvdXRTZWNvbmRzIjo2MCwiZXh0cmEiOnsibmFtZSI6IlVTREMiLCJ2ZXJzaW9uIjoiMiJ9fV19","resource_url":"https://api.example.com/premium-data","policy":{"pay_to":["0x209693Bc6afc0C5328bA36FaF03C514EF312287C"],"assets":["0x036CbD53842c5426634e7929541eC2318f3dCF7e"],"networks":["eip155:84532"],"max_amount":"10000","schemes":["exact"]}}}}' ``` The [MCP server page](https://settlens.com/mcp) shows how an agent acts on each decision, and the [MCP reference](https://settlens.com/docs/mcp) documents every argument and output field. > **Gate a release in CI** > > Pilot participants run the same checks against the live endpoint with the [Settlens CLI](https://settlens.com/docs/cli) and fail a build on a regression with the [GitHub Action](https://settlens.com/docs/github-action). ## Questions about the x402 checker **Is the x402 checker free?** Yes. It needs no account, wallet or payment key. Requests to the Settlens MCP endpoint, which the checker calls, are limited to 60 per minute per IP address. **Does the checker pay, sign or contact the paid resource?** No. It reads only what you paste. It never pays, signs or calls a facilitator, and it does not request the URL you enter: it only compares that URL with resource.url. **Why do I get review instead of pay?** A pay answer needs every protocol check to pass, the URL you requested, and a policy that sets pay_to, assets, networks and max_amount. When one is missing the answer is review, and the reasons say what is missing. **Does it support x402 V1?** No. It checks x402 V2 payment requests. A V1 request fails the V2 schema check and the answer is do_not_pay. The [migration guide](https://settlens.com/learn/x402-v1-to-v2-migration) lists what changed. ## Check the endpoint, not only its terms A pilot assesses one paid endpoint or facilitator: passive scan, CI gate, monitoring and signed evidence your partners can verify. [Request a pilot](https://settlens.com/contact) [See how Assess works](https://settlens.com/product/assess) ## Sources 1. [x402 Protocol Specification, version 2](https://github.com/x402-foundation/x402/blob/main/specs/x402-specification-v2.md) — x402 Foundation 2. [x402 V2 HTTP transport](https://github.com/x402-foundation/x402/blob/main/specs/transports-v2/http.md) — x402 Foundation 3. [CAIP-2: Blockchain ID Specification](https://github.com/ChainAgnostic/CAIPs/blob/main/CAIPs/caip-2.md) — Chain Agnostic Standards Alliance 4. [Model Context Protocol specification (2025-06-18): tools](https://modelcontextprotocol.io/specification/2025-06-18/server/tools) — Model Context Protocol