3 min read x402 Tools
The scan signs its offer, and we paid it once to see the receipt
The paid scan endpoint now signs its x402 offer, binds the key to its domain in DNS, and returns a signed receipt. We tested it with one real payment of our own.
Our paid scan endpoint now declares the offer-receipt extension of x402: the 402 answer carries a signed offer, and the answer to a paid request carries a signed receipt for the payment transaction.
Check the offer without paying
npx -y agent-receipt-verify https://x402.tokenizen.nl/api/bug-intel
reaches level 2: it asks for payment the way x402 says, declares the extension, and the signature of the offer verifies. The signer is 0xf30b0706E78b3166745E6a2f351992321088058f, a key that only signs and holds no funds. It is bound to the service domain in DNS, as section 4.5.1 of the extension describes: the TXT record at _controllers.x402.tokenizen.nl lists it as a controller.
One real payment
We paid the endpoint once with 5.1 USDC on Base mainnet, from our own address to our own payment address. That was a self test, so it is not a customer. The service queued the scan, delivered the report 35 seconds later and returned the receipt in the body and in the PAYMENT-RESPONSE header. A script checks six things: the receipt signature recovers to an address, the live offer is signed by the same address, that address is a controller in DNS, the transaction exists on Base, it is a USDC transfer to our payment address, and the payer in the receipt is the sender. All six pass.
What it does not show
- It shows that the service saw this payment and signed a receipt for it. It says nothing about how good the report is.
- It is one payment, by us, to ourselves. Nobody else has used the receipt yet.
- The DNS record was set about 15 minutes after that receipt was issued, and DNS keeps no history.
- It is a version 1 receipt. The salted commitment of version 2 waits for the specification.
- The conformance checker still shows level 3 as not measured, because it checks without paying.
The transaction, the answer, the delivered report and the script are in the evidence folder.