The State of x402 Conformance
Every dashboard counts x402 volume. This one asks a different question: of the endpoints actually live today, how many still speak the current version of the spec?
Host-weighted, not URL-weighted.
base) — works today, pre-standard · 78.6%eip155:8453) — current spec · 20.7%Measured by host, not URL — 198 distinct hosts sit behind ~12,000 raw "valid 402" URLs (one dead server farm alone is 89% of them). The scan probes 1–2 fresh URLs per host; the headline is built on the 140 that can take a mainnet payment.
It holds up after methodology fixes.
The denominator moves a little by design: scans 1–3 are same-day methodology fixes (a POST-fallback revived four live hosts → 146); scan 4 is the next day, when six mainnet hosts went dark in 24 hours.
The legacy share holds at ~3 in 4 throughout. The broken count dropped from 2 to 1 after one candidate was reclassified from FAIL to a softer interop warning — it uses a known USDC contract, so a payer can still sign.
Raw response snapshots (body hash, accepts[], x402Version) are kept per host, so the count is reproducible after drift, not just asserted.
base is WARN, not failure.
Facilitators still accept the old base string, so a payment on a legacy endpoint settles today — our own endpoint runs on it and has settled real payments. The risk isn't today. It's the v2-only client, the stricter facilitator, the cross-facilitator route that won't guess what base means.
Reproducible by host, not URL.
- Live, not cached. Every host is probed fresh — a real request, reading what a paying agent would read.
- By host, not URL. One server farm or preview cluster counts once, flagged separately, so it can't swing the percentage.
- Mainnet only in the headline. Testnet-only endpoints are reported apart from production players.
- Stress-tested. Two independent model reviews tried to break the number before it shipped. Both found real bugs in the scanner; both got fixed.
- Reproducible. Raw body hash,
accepts[]andx402Versionare saved per host. The number can be re-derived, not just trusted. - What it does not claim. A legacy
basename is a WARN, not a failure — payments still settle. "Broken" is reserved for a payer-breaking error like a malformed amount.
Endpoint telemetry, not volume theater.
Conformance is the public read of a deeper feed: continuous endpoint and settlement telemetry — who's paying whom, what's wash, what's real. The number above updates here; the story behind each move goes out in the weekly read.