One small JSON file on your domain tells every paying AI agent what you sell, what it costs, and which wallet gets paid. This page is the profile that defines that file — written for humans first, specified for machines below.
x402 uses HTTP status 402 Payment Required as the payment handshake: an unpaid call receives a 402 challenge naming price, asset, network and receiver; the caller pays on-chain and retries with proof. That handshake works only once an agent has already reached your endpoint. Discovery is the missing first step: a fixed, well-known location where agents learn that your domain sells anything at all. This profile defines that location and its contents.
| Field | Required | Meaning |
|---|---|---|
| x402Version | yes | The integer 2. Tells agents which schema to expect. |
| resources[] | yes | One entry per paid endpoint. At least one entry. |
| resources[].resource | yes | Full https URL of the paid endpoint agents will call. |
| resources[].method | yes | HTTP method, usually POST. |
| resources[].description | recommended | Plain words: what the agent gets for the payment. |
| resources[].accepts[] | yes | Payment terms the endpoint accepts (first entry is primary). |
| accepts[].network | yes | CAIP-2 chain id. Base mainnet is eip155:8453. |
| accepts[].asset | yes | Token contract address (USDC on Base: 0x8335…2913). |
| accepts[].amount | yes | Price in token base units, as a string. USDC has 6 decimals, so "100000" = 0.10 USDC. |
| accepts[].payTo | yes | The receiving wallet. Your wallet. |
| accepts[].scheme | recommended | Payment flow name, e.g. pay-then-prove. |
| accepts[].maxTimeoutSeconds | optional | How long the endpoint waits for payment proof. |
| verify / mcp / llms / spec | recommended | Top-level machine pointers: how to verify you, your MCP server, your llms.txt, this profile. |
Canonical live example: ironbridge.foundation/.well-known/x402 — three paid endpoints, receipt-sealed.
The validator runs eight checks and grades A–F. The checks are normative:
8/8 = A (conformant) · 7/8 = B (payable; listed in the index) · below B = not yet payable by agents. A resource that takes payment through another domain's hosted service cannot be probed live (check 8), so those files top out at B — still listed, still payable.
Anything that fetches these files automatically should behave like our validator: fixed path only, https only, never follow redirects, refuse private and internal hosts, cap size and time, and treat file contents as data — never as instructions.
Honestly: this convention is new. As of 2026-08-26 none of the x402 operators we surveyed — including the largest — publishes a discovery file; most domains still grade F. IronBridge maintains this profile, the free validator, the file builder, and the automatically-verified index of domains that pass. The profile is open: adopt it with no permission from us, and propose changes by reaching us at build@ironbridge.foundation.