Make one unpaid request to the endpoint that normally requires payment, then inspect its payment-required response. In HTTP x402 v2, the signed-offer extension—if the service provides it—is carried in the PAYMENT-REQUIRED header. Finding an offer is only the first check: you must verify its signature and establish that its signer is authorized for the service.
What the 35-host figure does—and does not—say
A report indexed from DEV says its author checked 35 hosts on the then-public x402 discovery list on August 3, 2026. The report says 34 returned no signed offer and the remaining host attempted to sign offers, but its signatures did not parse. The article was reported on September 3, 2026. This is an attributed snapshot of that author’s sample, not an independently repeated census, a current host count, or a finding about every x402 service. Read the indexed report.
As an Amazon Associate I earn from qualifying purchases.
The scope matters: x402 discovery is not necessarily a complete list of services. The protocol documents GET /discovery/resources, while the x402 Foundation describes Bazaar, its discovery layer for compatible HTTP endpoints and MCP tools, as being in early development, with features and APIs subject to change. A count from a discovery list is a count of that list at the time it was checked—not automatically a count of the whole ecosystem. See the Bazaar documentation and the x402 v2 specification.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteCheck for an offer with one unpaid request
x402’s HTTP flow lets a client request a resource, receive payment requirements when payment is needed, and then make a later request carrying signed payment authorization. To check whether an offer is present, you only need the first response. Do not submit payment authorization just to inspect the offer.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Request the protected resource without payment. Use the endpoint and request that ordinarily require payment. A payment-required response supplies the terms the client needs to proceed.
- Inspect the response using the endpoint’s protocol version. For HTTP v2, locate the base64-encoded
PAYMENT-REQUIREDresponse header and decode and parse it according to the transport specification. - Look for the optional offer extension. In the parsed payment-required object, check for the
offer-receiptextension and its offers array. The extension describes offers as paired with accepted payment terms. If the extension is absent, report that this response contained no signed offer; absence alone does not establish a violation of the base payment flow.
The signed-offer and receipt mechanism is an optional, composable extension, not a requirement of every ordinary x402 payment response. Its absence means the endpoint did not provide a signed offer in the response you inspected. See the Offer and Receipt Extension.
Verify the offer, then authorize its signer
A parsed offer is not yet a verified service commitment. Follow the extension’s verification procedure for the offer’s declared signature format, such as EIP-712 or JWS, including its version checks and verification over the transmitted offer payload.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Check the signed terms. Confirm that the signed payload’s resource and payment fields match the accepted payment terms in the response. Do not treat an unsigned convenience field such as
acceptIndexas authoritative. - Check the signature. A valid cryptographic signature establishes that a particular key signed the artifact. It does not establish that the key belongs to, or is authorized to represent, the service identified by
resourceUrl. - Check service authorization separately. The extension describes possible authorization mechanisms including signing with the
payToaddress, a domain-linkeddid:webdocument, DNS TXT bindings, and external registries. Apply the mechanism the service declares and confirm that it binds the signer to the relevant service. - Check the offer’s time bounds. If the offer includes
validUntil, establish whether it is still valid for the time and purpose of your request.
The extension states: “Verifiers MUST distinguish between signature validity and signer authorization.” A valid signature from an unrelated key is not proof that the service committed to those terms.
For a historical audit, current authorization records may not prove what was authorized when an offer was issued: DID documents and DNS records can change. The extension notes that evidence of authorization at issuance may require a temporally immutable source, such as an attestation or transparency log.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
Report the result without overclaiming
State what you observed and which checks passed. Useful, precise outcomes include:
- “No signed offer was present in this response.”
- “Offer signature invalid.”
- “Signature valid; signer authorization not established.”
- “Signature and service authorization verified.”
Scope the result to the endpoint response and time you checked. A single request does not establish that the endpoint will behave the same way later, or that other services on a discovery list have the same behavior.
Quick Recap
Rank #4
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
