Explore Tests
Pick a test, point your client at the endpoint, and see exactly what it does. Every test is a link, so you can share one or bookmark it. Testnets only, and nothing is stored.
- v1 network name
A v2 challenge naming the network base-sepolia instead of eip155:84532.
Your client should Refuse it.
- No version field
The challenge omits x402Version entirely.
Your client should Refuse it rather than assume a version.
- Undecodable header
The PAYMENT-REQUIRED header is not valid base64.
Your client should Fail cleanly, and not crash.
- No challenge header
A bare 402 with no PAYMENT-REQUIRED header at all.
Your client should Treat it as unpayable, and not hang.
- Mismatched payTo
The recipient is not the one the endpoint was configured with.
Your client should Notice who it is about to pay.
- Inflated amount
The amount is 1000x the price, still atomic-shaped.
Your client should Catch it against its own maximum, or the asset's decimals.
- Oversized challenge header
A challenge header padded to ~14KB on Base Sepolia, over the 8KB buffer many proxies enforce.
Your client should Fail cleanly; a reduced-limit HTTP parser rejects the response.
- Amount as a number
A challenge whose amount is a bare JSON number, not an atomic-units string.
Your client should Refuse it, or read the amount as a big-integer string.
- No window to pay
An x402 challenge offering maxTimeoutSeconds of 0, so there is no time in which the payment could land.
Your client should Refuse a challenge it cannot satisfy in time.
- Version as a string
An x402 challenge whose x402Version is the string "2" where the spec requires the number 2.
Your client should Refuse it rather than coerce the version and carry on.
- Offer signature does not verify
A well-formed signed offer whose signature will not verify against the published key.
Your client should Refuse it. Checking the shape is not checking the signature.
- Offer that already expired
A genuinely signed offer whose validUntil is in the past. The signature is valid; the commitment is not.
Your client should Refuse it rather than trust a valid signature over a dead expiry.
- Offer contradicts the challenge
The signed offer commits to 1000x the amount its accepts entry advertises, while acceptIndex still points straight at that entry.
Your client should Refuse it. Match offers to accepts by the signed fields, not by acceptIndex.
- Expired MPP challenge
An MPP challenge on Base Sepolia whose WWW-Authenticate expires is in the past.
Your client should Refuse a challenge it cannot satisfy in time.
- MPP legacy network name
An MPP challenge whose request payload names the network base-sepolia rather than eip155:84532.
Your client should Refuse it rather than guess which chain it means.
- MPP undecodable request
An MPP challenge whose base64url request parameter is not decodable at all.
Your client should Fail cleanly, and not crash.
- MPP 402 with no challenge
A bare 402 and a problem+json body, with no WWW-Authenticate header to answer.
Your client should Treat it as unpayable, and not hang.
- MPP mismatched recipient
An MPP challenge on Base Sepolia paying an address the endpoint was not configured with.
Your client should Notice who it is about to pay.
- MPP inflated amount
An MPP challenge whose request payload asks 1000x the price, still atomic-shaped.
Your client should Catch it against its own maximum, or the asset's decimals.
- MPP amount as a number
An MPP request payload whose amount is a bare JSON number instead of an atomic-units string.
Your client should Refuse it, or read the amount as a big-integer string.
- Oversized MPP header
An MPP challenge padded past the 8KB header buffer many proxies and hardened clients enforce.
Your client should Fail cleanly; a reduced-limit HTTP parser rejects the response.
- MPP challenge with an empty id
An MPP challenge carrying id="", which the draft says a server must never send.
Your client should Reject it, as the draft requires of every parser.
New to either protocol? Read what x402 and MPP put on the wire.
Build a custom testChoose the network, price, facilitator, and exactly how the endpoint should misbehave.