0.1.6 • Published 14h ago
@1x402/x402-validator
Licence
MIT
Version
0.1.6
Deps
0
Size
29 kB
Vulns
0
Weekly
0
@1x402/x402-validator
Validate whether a host implements the x402 protocol, and get a detailed per-endpoint report — how many paid endpoints were found, how many are valid, and exactly why the invalid ones fail.
Dependency-free and web-standard (fetch / atob / AbortSignal.timeout), so it runs in Cloudflare Workers, Node 20+, Deno, and the browser.
npm i @1x402/x402-validatorUsage
import { validateOrigin } from "@1x402/x402-validator";
const report = await validateOrigin("https://example.com");
report.compliant; // true — at least one valid x402 paid endpoint
report.summary; // { found, probed, valid, invalid, skipped }
report.payment; // { payTo, chain, asset, scheme, amountMicro } (Base-EVM preferred)
report.payableOnBase; // can a Base USDC wallet pay this host?
for (const e of report.endpoints) {
if (!e.valid) console.log(e.method, e.path, e.reasons); // why it failed
}What it checks
Per the x402 spec ("quickstart for sellers"), each endpoint is probed unpaid and its 402 challenge validated:
| Check | Requirement |
|---|---|
| status | the unpaid request returns HTTP 402 |
| header | a payment-required header that decodes as base64(JSON) |
| accepts | ≥1 accepts[] option with a known scheme (exact / upto / batch-settlement), a CAIP-2 network, a payTo, an asset, and a positive-integer amount |
Templated paths (/x/{id}) and endpoints beyond maxEndpoints are reported as skipped (not invalid) — a literal probe would 404 and read as a false negative.
API
validateOrigin(origin, opts?)→ValidationReport— discover paid endpoints from/openapi.json, probe each, aggregate.validateEndpoint({ method, path, url }, opts?)→EndpointReport— probe one endpoint.evaluateChallenge(meta, status, header)→EndpointReport— pure, no network.decodeChallenge(header),validateAccept(accept, i),pickPayment(reports)— building blocks.
opts: { fetch?, timeoutMs = 8000, maxEndpoints = 25, concurrency = 6 }.
MIT