$ curl -i https://test402.com/api/x402
HTTP/1.1 402 Payment Required
payment-required: eyJ4NDAyVmVyc2lvbiI6MiwiZXJyb3IiOi…
content-type: application/json
{"x402Version":2,"error":"PAYMENT-SIGNATURE header is required","resource":{"url":"https://test4…
# sign the challenge, then ask again
$ curl -i -H 'PAYMENT-SIGNATURE: 0x9f2c…e41b' https://test402.com/api/x402
HTTP/1.1 200 OK
{"ok":true,"note":"test402 checked only that a PAYMENT-SIGNATURE header was pres…
How it works
- 1
Pick a test
Choose a ready-made scenario, or compose your own -- network, price, facilitator, and how the challenge should misbehave.
- 2
Point your client at the URL
Every test is a plain endpoint. No signup, no keys. Copy the URL or the curl command and send your client at it.
- 3
See exactly what it does
Compliant challenges should be paid; broken ones should be refused or fail cleanly. The endpoint returns precisely what the test promises.
Start with these
A well-formed challenge and a couple your client should turn down.
- Compliant on Base Sepolia
A well-formed x402 v2 challenge. USDC on Base Sepolia.
Your client should Pay it.
- v1 network name
A v2 challenge naming the network base-sepolia instead of eip155:84532.
Your client should Refuse it.
- Inflated amount
The amount is 1000x the price, still atomic-shaped.
Your client should Catch it against its own maximum, or the asset's decimals.
Every test is customizable
Start from any scenario and change the network, price, facilitator, or exactly how it misbehaves. The whole test lives in the URL, so you can still share or bookmark the result.
Compliant and broken
Real client-breaking shapes seen in the wild -- v1 names in v2 envelopes, undecodable headers, inflated amounts -- each labeled with what a correct client should do.
Real responses, no drift
The preview runs through the same code as the endpoint, so what you see is byte-for-byte what your client receives -- down to the 400 for a malformed config.
Testnet only, never redeemed
Every network is a testnet, and test402 never redeems what you sign: it reads the signature, answers 200, and never submits it on-chain. The payment you authorize is never taken, so a client here cannot move money, however badly it behaves. No accounts, no logs.
Point your client at a test
Find out how it handles the challenges it will actually meet in the wild. It takes one URL.