x402lab: an API that AI agents pay for, per call

We built a small crypto-data API that AI agents can pay for directly — no accounts, no subscriptions, no credit cards. Each call is settled in USDC on Base using the emerging x402 payment standard. Here's what we made and how it works.

Why "pay per call" at all

The web's business models — ads and subscriptions — assume a human on the other end. An autonomous AI agent doesn't watch ads and won't sign up for a monthly plan to make one query. As agents start doing real work, they need a way to pay for a single API call, right when they make it.

That's exactly what x402 enables. It revives the long-dormant HTTP status code 402 Payment Required: a server can answer a request with "here's the price," and a payment-capable client can pay and retry — all inside normal HTTP, settled on-chain in stablecoins. No API keys to provision, no invoices, no card on file.

What we built

x402lab is a tiny API that sells crypto-safety data. It has two paid endpoints and a free health check:

The token report scores a token against 30+ rug-pull signals — honeypots, mutable taxes, mint/freeze authorities, unlocked liquidity, holder concentration and more — pulling from free, key-less sources (DexScreener, GoPlus for EVM chains, RugCheck for Solana). The wallet report returns a read-only portfolio snapshot for any public address. Everything reads public on-chain data; no one hands us a wallet or a key.

It lives at api.htsapp.tech, with interactive docs at /docs.

How a paid call works

The whole exchange happens in two HTTP round-trips:

1. An agent calls a paid endpoint. With no payment attached, the server replies HTTP 402 and a machine-readable accepts block: price, asset (USDC), network (Base), and the receiving address.
2. The agent's x402-enabled HTTP client reads that, signs a USDC payment authorization (an EIP-3009 transferWithAuthorization) and retries the request with an X-PAYMENT header. It's gasless for the payer — the facilitator sponsors the gas.
3. The server verifies the signature with a facilitator, does the work, then settles on Base — the USDC actually moves — and returns the data plus an X-PAYMENT-RESPONSE header carrying the on-chain transaction hash.

A crucial detail: verify only checks that a payment is valid; settle is what moves the money. A server that forgets to call settle would give its data away for free. Our gate is deliberately fail-closed — if settlement doesn't succeed, the data is withheld and a 402 is returned. You can never accidentally serve an unpaid response.

Also on MCP — for discovery

Agents need to find a tool before they can pay for it. So x402lab also speaks the Model Context Protocol at mcp.htsapp.tech/mcp (Streamable-HTTP). The MCP tools return free but truncated previews — a headline risk level, a couple of flags — and point the agent to the paid endpoint for the full report. MCP is the shop window; the paywall stays at the HTTP layer where funded agents already know how to pay a 402.

The engineering, honestly

Two things were more interesting than expected:

• Settlement auth. Real USDC settlement on Base mainnet runs through Coinbase's CDP facilitator, which authenticates every request with a short-lived, per-request signed token. We wired that in with Coinbase's SDK rather than hand-rolling the crypto.
• A very stubborn 401. For a while, perfectly valid API keys were rejected with a generic "Unauthorized." It wasn't the key, the permissions, or the country — the server was reaching Coinbase over IPv6 by default, while the key's allow-list only had our IPv4 address. Coinbase saw an un-listed source and refused. Forcing IPv4 on those calls fixed it instantly. A good reminder that "401" sometimes means "wrong network path," not "wrong credentials."

Try it

Inspecting the 402 challenge is free — no wallet needed:

curl -i https://api.htsapp.tech/v1/token/base/0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

With an x402-capable client and a little USDC on Base, that same call returns the full report and a settlement receipt. It's a small building block, but it's a working example of something new: software that other software can simply pay.