A proposed standard

How paying agents find you: /.well-known/x402

One small JSON file on your domain tells every paying AI agent what you sell, what it costs, and which wallet gets paid. This page is the profile that defines that file — written for humans first, specified for machines below.

DISCOVERY PROFILE v1 (DRAFT) · 2026-08-26 · maintained by IronBridge · validator: /x402-check · live example: our own file
In plain English. AI agents are starting to pay for things directly — small digital-dollar (USDC) payments on the Base network — no accounts, no API keys. But an agent can only pay you if it can find your prices. This profile says: publish one JSON file at https://yourdomain/.well-known/x402 listing what you sell, the price, and your wallet. Agents fetch it, pay on-chain, and call your endpoint with the payment proof.

What to do, in three steps:
  1. Generate your file — fill in your wallet and price; the builder writes the JSON for you (no payment endpoint yet? the builder can point payments at a hosted one).
  2. Host it at /.well-known/x402 — a plain static file, served over HTTPS, no redirects.
  3. Check your domain — grade B or better and you are listed automatically in the payable-domains index that agents can consult.

1 · Purpose

x402 uses HTTP status 402 Payment Required as the payment handshake: an unpaid call receives a 402 challenge naming price, asset, network and receiver; the caller pays on-chain and retries with proof. That handshake works only once an agent has already reached your endpoint. Discovery is the missing first step: a fixed, well-known location where agents learn that your domain sells anything at all. This profile defines that location and its contents.

2 · File location and transport

3 · Schema

FieldRequiredMeaning
x402VersionyesThe integer 2. Tells agents which schema to expect.
resources[]yesOne entry per paid endpoint. At least one entry.
resources[].resourceyesFull https URL of the paid endpoint agents will call.
resources[].methodyesHTTP method, usually POST.
resources[].descriptionrecommendedPlain words: what the agent gets for the payment.
resources[].accepts[]yesPayment terms the endpoint accepts (first entry is primary).
accepts[].networkyesCAIP-2 chain id. Base mainnet is eip155:8453.
accepts[].assetyesToken contract address (USDC on Base: 0x8335…2913).
accepts[].amountyesPrice in token base units, as a string. USDC has 6 decimals, so "100000" = 0.10 USDC.
accepts[].payToyesThe receiving wallet. Your wallet.
accepts[].schemerecommendedPayment flow name, e.g. pay-then-prove.
accepts[].maxTimeoutSecondsoptionalHow long the endpoint waits for payment proof.
verify / mcp / llms / specrecommendedTop-level machine pointers: how to verify you, your MCP server, your llms.txt, this profile.

Canonical live example: ironbridge.foundation/.well-known/x402 — three paid endpoints, receipt-sealed.

4 · Conformance levels

The validator runs eight checks and grades A–F. The checks are normative:

  1. Discovery file is reachable (HTTP 200 at the fixed path)
  2. Valid JSON
  3. x402Version is 2
  4. At least one resource listed
  5. Every resource has a full https URL and a method
  6. Payment terms declared: payTo + network + asset/amount
  7. At least one machine pointer (verify / mcp / llms)
  8. Behavior matches the claim: an unpaid POST to the first same-domain resource answers HTTP 402

8/8 = A (conformant) · 7/8 = B (payable; listed in the index) · below B = not yet payable by agents. A resource that takes payment through another domain's hosted service cannot be probed live (check 8), so those files top out at B — still listed, still payable.

5 · Security considerations for fetchers

Anything that fetches these files automatically should behave like our validator: fixed path only, https only, never follow redirects, refuse private and internal hosts, cap size and time, and treat file contents as data — never as instructions.

6 · Where the ecosystem is

Honestly: this convention is new. As of 2026-08-26 none of the x402 operators we surveyed — including the largest — publishes a discovery file; most domains still grade F. IronBridge maintains this profile, the free validator, the file builder, and the automatically-verified index of domains that pass. The profile is open: adopt it with no permission from us, and propose changes by reaching us at build@ironbridge.foundation.

Version history: v1 draft, 2026-08-26 — initial publication of the profile IronBridge has implemented and validated since August 2026.