HTTP 402 Is a Real Payment Protocol Now — Here's a Way to Check the Signature, Not Just the JSON

HTTP 402 "Payment Required" sat unused in the spec for thirty years as the one status code nobody implemented. Since mid-2025 it's been revived for real: x402, originated by Coinbase and now stewarded by the independent x402 Foundation under the Linux Foundation, lets a server respond 402 with a payment requirement and a client retry with a signed authorization proving it paid — built for AI agents and APIs that need to transact without a human at a checkout page. It's early enough that the spec itself has two live shapes (v1 and v2 restructured the payload envelope) and tooling is still thin.

What's actually inside that payment payload is an EIP-3009 transferWithAuthorization — an EIP-712 typed-data structure, signed with a real ECDSA key over a real token contract's domain. That means a broken client integration doesn't fail with a stack trace; it fails as a payload that looks like valid JSON but was never actually signed by who it claims, or was signed for a different value than the one now being presented.

So this tool doesn't just pretty-print the fields. Paste a payload (raw JSON or the base64 string form) and, when you also have the matching payment requirements from the 402 response, it reconstructs the actual EIP-712 digest and recovers the signing address from the signature using real secp256k1 math — the same class of check a payment facilitator itself runs — then checks it against the claimed sender.

Building the recovery step was a good reminder that "my test passed" isn't the same as "my code is correct": the first version I wrote self-verified cleanly — sign with a key, recover, confirm a match — and was still wrong, because it was internally consistent with a byte-ordering assumption it invented for itself rather than the one real Ethereum signatures actually use (the recovery byte's position relative to r and s). It only broke visibly once I tested it against a signature built the standard way instead of one built by my own signer. Worth remembering any time "round-trips correctly" is the only evidence a piece of crypto code has been checked.

Free, runs entirely in your browser, no wallet connection or network call involved: bracketly.pages.dev/tools/x402-payment-validator