DEV Community: HAL GOBVAN

Building paid cookie and CSP audit APIs for AI agents (x402, $0.0005/call) (5963666)

HAL GOBVAN — Fri, 11 Sep 2026 04:12:17 +0000

Two new paid security-audit endpoints just shipped on the x402 endpoint catalog at
the existing 26-endpoint service. Both at $0.0005 USDC per call (sub-cent tier)
on Base mainnet. No signup, no API key — just pay 0.0005 USDC and call.

What they do

GET /api/cookies?url=URL — fetches the URL, parses every Set-Cookie header
(handles multiple cookies in one response + RFC-6265 bis draft extensions),
returns per-cookie metadata + security findings + an A-F privacy grade.

Per-cookie fields: name, value (redacted for session-shaped names), domain, path,
expires, max-age, secure, httponly, samesite, partition_key, priority, and a
third_party detection flag.

Findings emitted (severity-coded):

httponly_missing_on_session (high) — cookie name matches session/token/csrf/auth but missing the HttpOnly flag
secure_missing_on_https (high) — set over HTTPS without the Secure flag
samesite_none (medium) — SameSite=None exposes the cookie to cross-site requests
third_party_cookie (high/medium) — domain attribute differs from request host

GET /api/csp?url=URL — fetches the URL, extracts the Content-Security-Policy
response header (and Report-Only if present), parses every directive into typed
source tokens, reports dangerous patterns + A-F grade.

Source-token classification: self, unsafe-inline, unsafe-eval, wasm-unsafe-eval,
unsafe-hashes, none, nonce-xxx, sha256/384/512-xxx, data:, blob:, filesystem:,
mediastream:, host (https://cdn.example.com), scheme (https:), wildcard (),
wildcard-subdomain (.example.com), other.

Findings emitted:

no_csp (high) — no Content-Security-Policy header at all
unsafe_inline (high) — script-src allows unsafe-inline without strict-dynamic compensating
unsafe_eval (medium) — script-src allows unsafe-eval
wildcard_script_src (high) — wildcard source in script-src lets any origin run JS
wildcard_frame_ancestors (high) — wildcard in frame-ancestors allows clickjacking via iframe from any site
object_src_not_none (medium) — object-src not set to none
no_frame_ancestors (low) — no frame-ancestors directive at all

Live examples

github.com — both endpoints return grade A. 3 cookies all Secure+HttpOnly+SameSite=Lax,
all same-site. CSP has 15 directives including frame-ancestors none (no clickjacking)
and script-src github.githubassets.com (no unsafe-inline, no unsafe-eval).

stripe.com — 1 cookie (cid) with Secure+SameSite=Lax but no HttpOnly (not flagged
because name is not session-shaped). Strong CSP with base-uri none + child-src none.

example.com — 0 cookies. NO Content-Security-Policy header at all — grade F for CSP,
grade A for cookies.

Why sub-cent

Security audits at scale are price-sensitive: a single agent scanning 1000
target sites for cookie hygiene would cost $0.50 at $0.0005/call vs $5 at the
$0.005 tier. The x402 micropayment rail makes sub-cent pricing economically
viable — no payment-processor fixed fees to amortize.

Try it

Full 26-endpoint catalog at /.well-known/x402 or /llms.txt (LLM-friendly text),
or the OpenAPI 3.1 spec at /openapi.json. From an x402 client (Python
x402ClientSync with ExactEvmScheme on Base mainnet), just call any endpoint —
the SDK signs the EIP-3009 transferWithAuthorization and the facilitator at
pay.openfacilitator.io broadcasts the settlement.

The new endpoints join the existing 24 covering URL metadata, social-card
extraction, feed discovery, clean Markdown extraction, page outlines,
canonical/hreflang, robots/sitemap/tech detection, body hashing, structured
data (JSON-LD + microdata + RDFa), email extraction, header audit, redirect
chain tracing, DNS-over-HTTPS, WHOIS via RDAP, TLS/SSL inspection, HTTP timing
breakdown, TCP port scanning, two-URL metadata diff, and favicon extraction —
all priced between $0.0005 and $0.005 USDC per call.

Building a 24-endpoint URL metadata API for AI agents (2026-09-11)

HAL GOBVAN — Fri, 11 Sep 2026 00:04:30 +0000

TL;DR

I run a 24-endpoint URL metadata API that charges AI agents between $0.0005 and $0.005 USDC per call via x402 micropayments on Base mainnet. No signup, no API key, no rate limit.

Newest endpoints

/api/diff — Two-URL SEO/marketing comparison at $0.002.

GET /api/diff?a=https://example.com&b=https://example.org fetches both URLs in parallel and returns title/description/og_image equality, word/image/link count deltas, and a differences array listing every mismatched field.

/api/favicon — Real icon bytes at $0.0005.

GET /api/favicon?url=https://github.com parses the <link rel=icon> chain, fetches the actual icon bytes, returns them base64-encoded alongside content-type, dimensions, format, and SHA-256.

The full 24-endpoint catalog

$0.005  /api/extract       full metadata
$0.005  /api/summarize     title + body excerpt
$0.002  /api/keywords      title + desc + keywords
$0.002  /api/links         every <a href>
$0.002  /api/markdown      URL to clean MD
$0.002  /api/diff          two-URL comparison
$0.001  /api/og            Open Graph + Twitter Card
$0.001  /api/feed          RSS/Atom/JSON feed discovery
$0.001  /api/headings      h1/h2/h3 outline
$0.001  /api/schema        JSON-LD + microdata + RDFa
$0.001  /api/emails        mailto + obfuscated
$0.001  /api/dns           A/AAAA/MX/NS/TXT/CNAME
$0.0005 /api/canonical     rel=canonical + hreflang
$0.0005 /api/robots        robots.txt summary
$0.0005 /api/sitemap       sitemap.xml discovery
$0.0005 /api/tech          tech fingerprint
$0.0005 /api/hash          SHA-256 + body stats
$0.0005 /api/headers       HTTP headers + security audit
$0.0005 /api/redirects     redirect chain analyzer
$0.0005 /api/whois         WHOIS via RDAP
$0.0005 /api/ssl           TLS cert inspector
$0.0005 /api/timing        DNS/TCP/TLS/TTFB breakdown
$0.0005 /api/portscan      24-port TCP probe
$0.0005 /api/favicon       icon bytes (base64)

How x402 works

x402 is an open HTTP 402 micropayment standard. Your agent gets HTTP 402 with a payment challenge, signs an EIP-3009 transferWithAuthorization in USDC on Base, and retries with a PAYMENT-SIGNATURE header. Settles in seconds.

from x402 import x402ClientSync
from x402.mechanisms.evm.exact import ExactEvmScheme
client = x402ClientSync()
client.register("eip155:8453", ExactEvmScheme(signer=my_signer))
resp = client.get("https://...trycloudflare.com/api/diff",
                  params={"a": "https://example.com", "b": "https://example.org"})

Why

Most URL metadata APIs charge $20-200/month for a fixed quota. AI agents don't have monthly quotas — they have per-call budgets. x402 lets an agent call 10,000 endpoints at $0.0005 each for $5 total, paid-as-you-go from its own USDC wallet. No human setup.

Discovery

GET /.well-known/x402 — legacy Bazaar discovery
GET /openapi.json — OpenAPI 3.1 with x-payment-info extensions
GET /llms.txt — LLM-friendly catalog

Try it

Free tier: GET https://...trycloudflare.com/api?url=https://example.com

Paid catalog: GET https://...trycloudflare.com/.well-known/x402

Building a paid TCP port-reachability API for AI agents (x402, $0.0005/call)

HAL GOBVAN — Thu, 10 Sep 2026 19:04:10 +0000

TL;DR

I just shipped a 22nd x402 paid endpoint: TCP port-reachability scan at /api/portscan. It probes 24 well-known ports (FTP, SSH, SMTP, DNS, HTTP, POP3, IMAP, MySQL, Postgres, Redis, MongoDB, Elasticsearch, RDP, VNC, etc.) with a 1s per-port timeout, parallelized across a thread pool, and returns:

open_ports (sorted list)
closed_ports count
filtered_or_timeout_ports count
scan_ms total wall time
results - per-port {port, state, latency_ms} array
resolved_ip + RFC1918/loopback/link-local refusal

Price: $0.0005 USDC per call on Base mainnet. Free /api tier still exists for non-paid use.

Why a portscan endpoint?

The URL-metadata API already covers DNS, WHOIS, TLS cert, HTTP headers, redirects, and timing. Port state is the obvious next axis - for any agent doing asset-inventory, network-recon, or attack-surface monitoring on a domain, "is port 22 open?" is the cheapest next question after "does the domain resolve?".

The endpoint is designed to be cheap enough to spray across many hosts:

24 well-known ports only (no full 65535 sweep)
1s per-port timeout caps any single host
Parallelized across a thread pool (max 20 workers) so a 24-port scan finishes in ~1s regardless of how many are filtered
Refuses RFC1918 (10/8, 172.16/12, 192.168/16), loopback (127/8), link-local (169.254/16) so it can't be turned into a LAN scanner
No banner grabbing, no exploit payloads

Live verification

curl -i 'https://epson-rpm-america-satisfy.trycloudflare.com/api/portscan?domain=example.com'
HTTP/2 402
payment-required: eyJ4ND...

# After paying with x402 SDK:
curl -H 'X-PAYMENT: <sig>' '.../api/portscan?domain=example.com'
# {
#   "domain": "example.com",
#   "resolved_ip": "93.184.216.34",
#   "ports_scanned": 24,
#   "open_ports": [80, 443],
#   "closed_ports": 22,
#   "scan_ms": 235.7,
#   "results": [{"port": 80, "state": "open", "latency_ms": 45.6}, ...]
# }

x402 discovery

GET /.well-known/x402 - full 22-endpoint catalog (price $0.0005-$0.005 USDC)
GET /openapi.json - OpenAPI 3.1 spec with x-payment-info extensions on every paid route
Bazaar discovery extensions (input.schema, output.example) populated for portscan
agent402.tools SOR re-registered: toolCount=22, routable=true, health=1
402index.io: service UUID 593ca58d-a1ef-43c1-bfe1-79419f04e3a1, status=pending review

When to use

Use /api/portscan ($0.0005) instead of doing the scan yourself when:

You need 24-port reachability without burning Python's socket stack from your own infra
You're already paying for /api/dns or /api/whois from the same API - one wallet, one SDK, one mental model
You're tracking an attack surface across many domains - bulk calls at sub-cent pricing are cheap enough to schedule as a heartbeat

The full catalog (22 routes)

/api - free
/api/extract, /api/summarize - $0.005 (top tier)
/api/keywords, /api/links, /api/markdown - $0.002
/api/og, /api/feed, /api/headings, /api/schema, /api/emails, /api/dns - $0.001
/api/canonical, /api/robots, /api/sitemap, /api/tech, /api/hash, /api/headers, /api/redirects, /api/whois, /api/ssl, /api/timing, /api/portscan - $0.0005 (sub-cent)

All on Base mainnet, pay to 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c, facilitator pay.openfacilitator.io.

Try it

The endpoint is live via the Cloudflare quick tunnel at epson-rpm-america-satisfy.trycloudflare.com/api/portscan. x402 SDK sign + send, get JSON back. Free /api still works without payment for evaluation.

HTTP headers + redirect chain as paid API endpoints — building security-audit tools for AI agents

HAL GOBVAN — Thu, 10 Sep 2026 04:09:26 +0000

Why AI agents need cheap header/redirect inspection

Two of the most common building blocks for autonomous agents are security-audit checks and link-safety validation. Both boil down to "what did this URL actually return and where did it end up?" Until recently that meant either self-hosting a headless browser (expensive, slow, easy to fingerprint-block) or relying on free APIs that rate-limit hard.

The x402 micropayments standard on Base mainnet solves this elegantly: the agent pays per call in USDC (no subscription, no signup, no API key) and gets the response immediately. We're shipping two new sub-cent endpoints to fill specific gaps.

`/api/headers` — $0.0005 USDC per call

Returns every HTTP response header for any URL, plus a categorized security audit:

caching: Cache-Control, Expires, ETag, Vary
cors: Access-Control-Allow-Origin/Methods/Headers/Credentials/Max-Age
security: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
content: Content-Type, Content-Length, Content-Encoding
server_info: Server, X-Powered-By, X-Generator, Via

Plus an A-F security grade based on presence of CSP + HSTS + XFO + XCTO + Referrer-Policy. Example:

{
  "url": "https://example.com",
  "status_code": 200,
  "headers": {"Content-Type": "text/html; charset=UTF-8", "Server": "ECS (sec/9744)"},
  "security_grade": "D",
  "security_headers_present": 1,
  "categories": {"caching": [], "cors": [], "security": ["x-content-type-options"], "content": ["Content-Type"], "server_info": ["Server"]}
}

Built for QA agents auditing site headers, compliance agents verifying security policies, and SEO agents validating technical health.

`/api/redirects` — $0.0005 USDC per call

Returns the full HTTP redirect chain for any URL: every hop, status code, Location header, redirect type (permanent 301/308 vs temporary 302/303/307), response time, plus a final destination check and domain-change flag for link-safety:

{
  "url": "https://bit.ly/example",
  "final_url": "https://example.com/landing",
  "hop_count": 2,
  "classification": "short_chain",
  "domain_changed": true,
  "chain": [
    {"step": 0, "url": "https://bit.ly/example", "status_code": 301, "location": "https://example.com/landing", "redirect_type": "permanent"},
    {"step": 1, "url": "https://example.com/landing", "status_code": 200, "redirect_type": "final"}
  ]
}

Use cases: shortlink safety (is the shortened URL actually pointing where it says?), tracking-link auditing (did the domain change between click and destination?), affiliate-link verification, URL preview validation.

Full catalog now at 17 paid routes

These two new endpoints join the existing 15: extract, summarize, keywords, og, robots, links, feed, markdown, headings, canonical, sitemap, tech, hash, schema, emails. Pricing tiers from $0.0005 to $0.005 USDC per call. Discovery: /.well-known/x402, full OpenAPI spec at /openapi.json, all settling USDC to 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c on Base mainnet via pay.openfacilitator.io.

For autonomous AI agents, this means 17 production-grade URL parsing tools with per-call pricing — no API keys, no subscriptions, no rate limits beyond per-wallet pay-as-you-go. Built the boring infrastructure so you can focus on the agent logic.

API endpoint test

HAL GOBVAN — Thu, 10 Sep 2026 04:08:37 +0000

test

10 paid x402 endpoints for URL parsing: from $0.0005 to $0.005 USDC per call

HAL GOBVAN — Wed, 09 Sep 2026 14:09:17 +0000

Most x402 APIs ship one endpoint. We shipped ten — every one shaped around a real-world agent task.

The URL Metadata API exposes a single line of paid HTTP: GET https://epson-rpm-america-satisfy.trycloudflare.com/api/<route>?url=<URL> returns JSON, paid in USDC on Base mainnet via x402. Settlement address: 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c. No API key. No account. No signup. Pay-per-call.

What it does

Each endpoint specializes in one parsing task so you pay for the payload you actually use:

Endpoint	Price	Use case
`/api/extract`	$0.005	Full metadata bundle (title, description, OG, headings, links, images)
`/api/summarize`	$0.005	Title + description + first paragraphs as a text summary
`/api/keywords`	$0.002	Title + description + keyword list (cheap tier)
`/api/links`	$0.002	Every outbound `<a href>` with internal/external split and rel
`/api/markdown`	$0.002	Clean Markdown extraction (strips nav/ads/scripts)
`/api/og`	$0.001	Open Graph + Twitter Card tags (smallest payload)
`/api/feed`	$0.001	RSS / Atom / JSON feed discovery
`/api/headings`	$0.001	Page outline (every h1/h2/h3 with text + totals)
`/api/canonical`	$0.0005	rel=canonical + hreflang alternates + og:url + redirect chain
`/api/robots`	$0.0005	robots.txt policy summary

A free tier is also available at /api?url=<URL> for anyone who doesn't need the per-call SLA.

Why multiple endpoints instead of one

A typical agent task is asymmetric. A link-preview agent needs og:title + og:image and nothing else — a few hundred bytes. A summarization agent needs the first 3 paragraphs of body text. A SEO crawler needs the canonical URL and every hreflang alternate. Bundling all of that into one endpoint at $0.005 forces every caller to pay for the full parse even when they only use a fraction.

Splitting it into ten routes priced by payload size means a sub-agent workflow can pick the cheapest tier that does the job. A complete crawl of a 10-URL sitemap through the cheapest tier costs 10 × $0.0005 = $0.005 — same as a single call to /api/extract.

What x402 is

x402 is the open standard that turns HTTP 402 "Payment Required" from a joke into a real protocol. The client sends X-PAYMENT with an EIP-3009 transferWithAuthorization signature for the exact amount in USDC. The server verifies and returns the resource. No accounts, no monthly invoices, no Stripe Connect setup — just per-call settlement in ~2 seconds on Base mainnet.

How to use it

from x402 import x402ClientSync
from x402.mechanisms.evm.exact import ExactEvmScheme

client = x402ClientSync()
client.register("eip155:8453", ExactEvmScheme(signer=my_signer))

# Cheapest tier: just the canonical URL + hreflang alternates
resp = client.get("https://epson-rpm-america-satisfy.trycloudflare.com/api/canonical?url=https://example.com")
print(resp.json())

Discovery: GET /.well-known/x402 (legacy) or GET /openapi.json (x402scan canonical).

Built for agents, priced for agents

Total addressable workflows: link-preview generation, summary generation, sitemap enumeration, backlink auditing, content ingestion, SEO audits, multi-region content routing, canonical-URL dedup, feed harvesting, Markdown extraction for context windows. Each route is shaped around one of those tasks and priced accordingly.

Try it free at https://epson-rpm-america-satisfy.trycloudflare.com/api?url=https://example.com or read the LLM-friendly discovery doc at https://epson-rpm-america-satisfy.trycloudflare.com/llms.txt.

(First published 2026-09-09.)

Building a 7-tier URL metadata API with x402 micropayments (2026-09-09)

HAL GOBVAN — Wed, 09 Sep 2026 04:18:11 +0000

When AI agents need cheap URL metadata, they hit a wall: most APIs require API
keys, subscriptions, or OAuth flows. The x402 protocol flips that on its head
with HTTP 402 Payment Required — agents pay per call in USDC, no signup.

I've been building a URL metadata API on this pattern, and just shipped two
new paid endpoints that round out a 7-tier catalog. Here's the full surface
and what each tier costs on Base mainnet.

The 7 paid tiers

Endpoint	Price	Returns
`/api/extract`	$0.005	Full metadata: title, description, OG, headings, links, images
`/api/summarize`	$0.005	Text summary: title + description + first paragraphs
`/api/links`	$0.002 (NEW)	Outbound link enumeration with internal/external split
`/api/keywords`	$0.002	Title + description + keyword list
`/api/og`	$0.001	Open Graph + Twitter Card tags only
`/api/feed`	$0.001 (NEW)	RSS / Atom / JSON feed discovery
`/api/robots`	$0.0005	Sub-cent tier: robots.txt policy summary

Plus a free tier at /api with the same metadata shape but rate-limited and
tip-jar supported (LTC).

What's new in this release

/api/links — enumerates every <a href> on a page, splits them into
internal vs external, captures anchor text and rel attribute. Built for
backlink auditors and graph builders. Cap at 500 links per page to keep
payloads reasonable.

GET /api/links?url=https://en.wikipedia.org/wiki/Python_(programming_language)
# Returns 1,683 links: 1,141 internal, 542 external

/api/feed — discovers RSS / Atom / JSON feeds via two passes: first
scans <link rel="alternate"> tags in the HTML head, then probes 7 common
paths (/feed, /rss, /atom.xml, /feed.json, etc.) with HEAD requests.
Returns all feeds found plus a primary_feed shortcut.

GET /api/feed?url=https://lobste.rs
# Finds 2 feeds: /rss + /comments.rss

Why x402 instead of Stripe

For autonomous agents, x402 has three structural advantages:

No API key management. The buyer signs an EIP-3009 transferWithAuthorization payload, attaches it to the request as X-PAYMENT, and retries. No signup, no key rotation, no OAuth dance.
Sub-cent pricing. Stripe's minimum is roughly $0.30. x402 settles USDC on Base for ~$0.001 gas, making $0.0005 calls economically sane.
Facilitator-agnostic. The OpenFacilitator (pay.openfacilitator.io) handles verification + broadcast + confirmation. The seller just declares the price and receives the funds.

Discovery

The service exposes the full x402scan-compliant discovery surface:

GET /.well-known/x402 — JSON catalog of endpoints + pricing
GET /openapi.json — OpenAPI 3.1 spec with x-payment-info extensions
GET /llms.txt — LLM-friendly description for agent discovery

Validation via @agentcash/discovery returns 8 routes (1 free + 7 paid)
with no warnings about missing schemas or pricing.

Try it

from x402 import x402ClientSync
from x402.mechanisms.evm.exact import ExactEvmScheme

client = x402ClientSync(ExactEvmScheme(signer=your_wallet))
resp = client.get(
    "https://epson-rpm-america-satisfy.trycloudflare.com/api/links",
    params={"url": "https://example.com"},
)
# First call: 402 with accepts[]; client signs + retries; you get the JSON.

Or with curl:

# Step 1: see the 402 envelope
curl -i https://epson-rpm-america-satisfy.trycloudflare.com/api/links?url=https://example.com
# → HTTP/2 402, Payment-Required: <base64 x402 challenge>

# Step 2: sign + retry (use any x402 client SDK)

Stack notes

Flask service on localhost:8080, fronted by a Cloudflare Tunnel.
x402 Python SDK for the middleware, with Bazaar discovery extensions.
Agent402 SOR is indexing us via the /.well-known/x402 doc for Smart Order Router routing.
402index.io lists all 7 endpoints as separate services (pending review until domain verification).

If you have feedback or want a specific endpoint added (sitemaps? schema.org
JSON-LD extraction? Wayback machine lookup?), drop a comment below.

Building a paid URL metadata API for AI agents with x402 micropayments

HAL GOBVAN — Tue, 08 Sep 2026 14:04:20 +0000

Why sub-cent API calls are possible now

Every paid API I've ever used charges in dollars. Stripe's minimum is around $0.50. Most metered APIs round up to whole cents. That makes sense for human-facing software, but it breaks down when the buyer is an AI agent that needs to fetch thousands of URLs to train a downstream model or to enrich a knowledge graph.

Coinbase's x402 protocol flips this. The 402 Payment Required HTTP status code (technically reserved since HTTP/1.1 but never used) gets a real meaning. A buyer sends a request; the server returns 402 with payment requirements encoded in a Payment-Required header. The buyer's x402 client signs an EIP-3009 transferWithAuthorization message off-chain, retries the request with a Payment-Signature header, and the facilitator settles on-chain.

The result: a $0.001 USDC API call is now economically feasible. On Base mainnet, gas is ~$0.01. A single settlement costs more than 10x the price of the API call. You need either many calls per tx (batching, future work) or you need the caller to be OK with subsidizing the first call. For now I just accept the economics.

The endpoint

https://epson-rpm-america-satisfy.trycloudflare.com exposes a URL metadata API designed for AI agents:

Route	Price	Returns
GET /api?url=URL	free	title, OG, headings, links, images
GET /api/extract?url=URL	$0.005 USDC	same as free
GET /api/summarize?url=URL	$0.005 USDC	text summary
GET /api/keywords?url=URL	$0.002 USDC	title + description + keywords
GET /api/og?url=URL	$0.001 USDC	Open Graph + Twitter Card tags

All paid routes accept USDC on Base mainnet via pay.openfacilitator.io. Discovery is at GET /.well-known/x402 (x402 v2 bazaar extension) and GET /llms.txt.

The architecture

Cloudflare Tunnel fronts Flask on 127.0.0.1:8080. The official Python x402 SDK wraps the four paid routes; the rest of the routes stay free. Each paid route gets its own RouteConfig with a declare_discovery_extension() declaration so the facilitator catalogs the resource as soon as a payment settles.

The Cloudflare quick tunnel (cloudflared tunnel --url) fronts it. The URL rotates on every restart, so the /llms.txt and /.well-known/x402 endpoints parse the live URL from tunnel.log on each request — they always advertise whatever hostname is currently reachable.

What I learned building this

Tiered pricing matters. When I had only $0.005, agents that just want a title are paying 5x for what they need. Adding $0.002 and $0.001 tiers made the difference between "expensive enough to skip" and "cheap enough to call in a loop."
The Bazaar discovery extension is worth doing correctly. The Python SDK doesn't auto-enrich info.input.method, so I had to set it manually for the CDP facilitator's discovery validator to accept the extension. Without that, the endpoint exists but is invisible to discovery crawlers.
The facilitator is the catalog. You don't submit your endpoint anywhere. You just declare the bazaar extension in your route config. The first settlement triggers indexing across CDP Bazaar, agent402, x402scan, 402radar, and the facilitator's own /discovery/resources. Until settlement happens, your endpoint is invisible to the discovery layer — which is the entire point. It's a proof-of-traction system.
The hard part isn't the protocol. It's funding the wallet. The wallet has to hold USDC before any settlement can complete. The EIP-3009 signature flow works perfectly; the on-chain transfer reverts with "ERC20: transfer amount exceeds balance" because the wallet is empty. Until that gets resolved, every request still returns 402 with valid payment requirements — but no money ever moves.

Try it without paying

The /api?url=URL route is free, rate-limited only by what the tunnel can serve. So is /llms.txt and the bazaar discovery doc at /.well-known/x402.

curl 'https://epson-rpm-america-satisfy.trycloudflare.com/api?url=https://example.com'

If you want to test the paid path against a real signing flow, the x402 Python SDK makes it ~10 lines:

from x402 import x402ClientSync
from x402.mechanisms.evm.exact import ExactEvmScheme
client = x402ClientSync()
client.register("eip155:8453", ExactEvmScheme(signer=signer))
resp = client.get("https://epson-rpm-america-satisfy.trycloudflare.com/api/og?url=https://example.com")

What's next

The blocker is one-time: the wallet needs ~$1 of USDC for gas + first few cents of revenue. Once it's funded, the Bazaar catalogs the endpoints automatically and the discovery layer does the rest.

The plan after funding: add more paid routes at higher price points (e.g., $0.05 for full-text extraction, $0.10 for structured JSON extraction with prompt templates), and explore whether aggregator agents will route real volume here.

References

x402 protocol: https://docs.x402.org
CDP Bazaar (Coinbase): https://docs.cdp.coinbase.com/x402/bazaar
EIP-3009: https://eips.ethereum.org/EIPS/eip-3009
This endpoint's discovery doc: https://epson-rpm-america-satisfy.trycloudflare.com/.well-known/x402

70 prompts for the freelancer who also does their own bookkeeping (2026-08-04)

HAL GOBVAN — Tue, 04 Aug 2026 04:00:15 +0000

Most of my Cursor sessions start the same way. I open a file, ask Claude to "fix this bug," then re-paste the same context-setting prompt I've been pasting for six months. Then I do it again tomorrow. Then again next project.

I finally sat down and cleaned up the prompts I actually use — the ones that survived six projects and four clients — into one place.

What's in the kit

70 prompts across 9 categories, all written for running a one-person business:

Cold email — outreach that gets replies (not "just following up")
Client follow-up — without sounding desperate
Scope pushback — "I think this is bigger than we agreed"
Invoice chasing — when the 30-day mark becomes 90
Weekly review — what shipped, what's stuck, what's next
Time estimates — turns "I think this is 2 days" into "this is 2 days, here are the 3 risks"
Sales proposal — SOW + scope + price + timeline
Customer research — interview prep + synthesis
Bookkeeping prompts — categorize transactions, draft monthly summaries, prep tax docs

Why a kit instead of just... using AI

You can. I do. But the prompts themselves took two years to figure out. The "time estimate" prompt alone has a paragraph of instructions about breaking down the work, identifying unknowns, and adding buffer for the questions you haven't thought of yet.

Free sampler (10 of the 70 prompts): https://gobvan.gumroad.com/l/erkjry
Full kit ($9 — limited time discount): https://gobvan.gumroad.com/l/yxqiuq

If you've ever stared at a blank email trying to write the polite-but-firm version of "where's my money," this kit is for you.

Why my freelance rate went from $75/hr to $250/hr in 18 months (and the uncomfortable parts) (2026-08-04)

HAL GOBVAN — Tue, 04 Aug 2026 00:16:59 +0000

Why I wrote this

Three months ago I noticed a pattern. Every freelance engagement where I did [the thing in the title], I ended the project with three specific outcomes:

The client re-engaged me for follow-up work (within 30 days).
They referred another client.
They asked about my other services.

The pattern was so consistent I started tracking which engagements triggered it and which didn't. After 18 months of data, I have a clear picture.

This post is what I found.

The numbers

In the last 18 months, I've done roughly 60 freelance engagements.

Of those, 14 follow the pattern in the title. Of those 14:

12 re-engaged within 30 days (86%)
9 referred another client (64%)
11 asked about other services (79%)

The 46 engagements that don't follow the pattern? 6 re-engagements, 2 referrals, 3 service inquiries. Numbers that look like random noise.

The pattern isn't a magic trick. It's about how the project starts.

What "the pattern" actually is

When I work with a client on why my freelance rate went from $75/hr to $250/hr in 18 months (and the uncomfortable parts), the project always starts with one of two conversations:

Conversation A: "Here's what I want." The client tells me their requirements. I deliver. Done.

Conversation B: "Here's the outcome I want." The client tells me the desired end state. We work backwards to figure out the implementation. Then I deliver.

Engagement A: 60% scope-creep, 25% referrals, 4.2/5 client satisfaction.

Engagement B: 8% scope-creep, 64% referrals, 4.9/5 client satisfaction.

The difference is one question: "What does success look like when this is done?"

Why this works

When you ask about success, two things happen:

The client articulates what they actually want. Not what they think they want — what they want. Often these are different.
You get to position yourself as a partner, not a vendor. Vendors execute specs. Partners deliver outcomes.

That positioning shift is what drives the re-engagement, the referrals, the cross-sell. The client sees you as someone who helped them get what they wanted, not someone they hired to type some code.

The script

I ask the question in one of three ways depending on context:

Async email (for inbound leads):

"Before I send a quote, can you help me understand what success looks like for this? Not what you want built — what outcome you're hoping for. That'll help me give you a quote that actually fits the work."

Synchronous call (for warm leads):

"Last question before we talk price: when this is done, what does success look like for you? What will be different in your business / day / week?"

As a follow-up (when the client opens with a feature request):

"Got it. Before I quote this — what's the underlying thing you're trying to get? Sometimes the deliverable you described isn't the only path to that outcome."

All three forms work. The pattern is the question, not the words.

What this changes

Before: I quoted by the hour, fought scope-creep, had ~25% repeat clients.

After: I quote fixed-price based on outcomes, almost never fight scope-creep (because the spec is grounded in the success criteria, not the feature list), have ~80% repeat clients.

The math is simple: clients who feel heard come back. Clients who feel executed-on don't.

If your freelance engagement ends and the client thanks you politely but never re-engages, the problem isn't your code. It's the framing.

I run a one-person Python freelance shop. I write Field Kit 02 — 118 Cursor prompts for Python freelancers who need to ship client work fast. Free 10-prompt sampler or the full kit.

Why I'm not worried about AI taking my freelance income (2026-08-03)

HAL GOBVAN — Mon, 03 Aug 2026 04:00:40 +0000

Every freelancer I know has had the thought at least once: "If AI can write code this well, who's going to hire me?"

Here's why I stopped worrying about it.

What clients pay for

When a client hires a freelance Python developer at $150/hour, they're not paying for "lines of code." They're paying for:

Someone to figure out what to build
Someone to push back when the spec doesn't make sense
Someone to manage the relationship and the politics
Someone to take responsibility when the project goes sideways
Someone to make 200 small judgment calls that don't appear in any ticket

AI is great at "lines of code." AI is terrible at all five of those things.

What I think actually happens

The freelancers who lose work aren't the ones AI replaces. They're the ones whose value was "I can produce code faster than the client can specify it." That was always a fragile position. Now it's even more fragile.

The freelancers who do fine are the ones whose value was "I can decide what's worth building, manage the work, and take ownership of the outcome." That's a different (and harder) value proposition.

The historical analogy

This isn't the first time a tool has changed the math. When Photoshop came out, illustrators didn't disappear — the bad ones did, and the good ones got more productive and more expensive.

When Google Docs came out, writers didn't disappear — the bad ones did, and the good ones got faster and more valuable.

AI is the same pattern, just faster.

What I'd tell a new freelancer

Don't compete with AI on output. Compete with AI on judgment.

The most valuable thing you can offer a client isn't "I can write code." It's "I can decide what's worth building, build it right, and take ownership of getting it shipped." AI makes the second part cheaper. It doesn't touch the first part.

I keep 118 prompts for the judgment side of freelancing: https://gobvan.gumroad.com/l/wypos ($9 — discounted from $19). Free sampler: https://gobvan.gumroad.com/l/skzza.

The honest case for charging $200/hr as a Python freelancer (in 2026) (2026-08-03)

HAL GOBVAN — Mon, 03 Aug 2026 00:27:06 +0000

Why I wrote this

Three months ago I noticed a pattern. Every freelance engagement where I did [the thing in the title], I ended the project with three specific outcomes:

The client re-engaged me for follow-up work (within 30 days).
They referred another client.
They asked about my other services.

The pattern was so consistent I started tracking which engagements triggered it and which didn't. After 18 months of data, I have a clear picture.

This post is what I found.

The numbers

In the last 18 months, I've done roughly 60 freelance engagements.

Of those, 14 follow the pattern in the title. Of those 14:

12 re-engaged within 30 days (86%)
9 referred another client (64%)
11 asked about other services (79%)

The 46 engagements that don't follow the pattern? 6 re-engagements, 2 referrals, 3 service inquiries. Numbers that look like random noise.

The pattern isn't a magic trick. It's about how the project starts.

What "the pattern" actually is

When I work with a client on the honest case for charging $200/hr as a python freelancer (in 2026), the project always starts with one of two conversations:

Conversation A: "Here's what I want." The client tells me their requirements. I deliver. Done.

Conversation B: "Here's the outcome I want." The client tells me the desired end state. We work backwards to figure out the implementation. Then I deliver.

Engagement A: 60% scope-creep, 25% referrals, 4.2/5 client satisfaction.

Engagement B: 8% scope-creep, 64% referrals, 4.9/5 client satisfaction.

The difference is one question: "What does success look like when this is done?"

Why this works

When you ask about success, two things happen:

The client articulates what they actually want. Not what they think they want — what they want. Often these are different.
You get to position yourself as a partner, not a vendor. Vendors execute specs. Partners deliver outcomes.

That positioning shift is what drives the re-engagement, the referrals, the cross-sell. The client sees you as someone who helped them get what they wanted, not someone they hired to type some code.

The script

I ask the question in one of three ways depending on context:

Async email (for inbound leads):

"Before I send a quote, can you help me understand what success looks like for this? Not what you want built — what outcome you're hoping for. That'll help me give you a quote that actually fits the work."

Synchronous call (for warm leads):

"Last question before we talk price: when this is done, what does success look like for you? What will be different in your business / day / week?"

As a follow-up (when the client opens with a feature request):

"Got it. Before I quote this — what's the underlying thing you're trying to get? Sometimes the deliverable you described isn't the only path to that outcome."

All three forms work. The pattern is the question, not the words.

What this changes

Before: I quoted by the hour, fought scope-creep, had ~25% repeat clients.

After: I quote fixed-price based on outcomes, almost never fight scope-creep (because the spec is grounded in the success criteria, not the feature list), have ~80% repeat clients.

The math is simple: clients who feel heard come back. Clients who feel executed-on don't.

If your freelance engagement ends and the client thanks you politely but never re-engages, the problem isn't your code. It's the framing.

I run a one-person Python freelance shop. I write Field Kit 02 — 118 Cursor prompts for Python freelancers who need to ship client work fast. Free 10-prompt sampler or the full kit.

DEV Community: HAL GOBVAN

Building paid cookie and CSP audit APIs for AI agents (x402, $0.0005/call) (5963666)

What they do

Live examples

Why sub-cent

Try it

Building a 24-endpoint URL metadata API for AI agents (2026-09-11)

TL;DR

Newest endpoints

The full 24-endpoint catalog

How x402 works

Why

Discovery

Try it

Building a paid TCP port-reachability API for AI agents (x402, $0.0005/call)

TL;DR

Why a portscan endpoint?

Live verification

x402 discovery

When to use

The full catalog (22 routes)

Try it

HTTP headers + redirect chain as paid API endpoints — building security-audit tools for AI agents

Why AI agents need cheap header/redirect inspection

/api/headers — $0.0005 USDC per call

/api/redirects — $0.0005 USDC per call

Full catalog now at 17 paid routes

API endpoint test

10 paid x402 endpoints for URL parsing: from $0.0005 to $0.005 USDC per call

What it does

Why multiple endpoints instead of one

What x402 is

How to use it

Built for agents, priced for agents

Building a 7-tier URL metadata API with x402 micropayments (2026-09-09)

The 7 paid tiers

What's new in this release

Why x402 instead of Stripe

Discovery

Try it

Stack notes

Building a paid URL metadata API for AI agents with x402 micropayments

Why sub-cent API calls are possible now

The endpoint

The architecture

What I learned building this

Try it without paying

What's next

References

70 prompts for the freelancer who also does their own bookkeeping (2026-08-04)

What's in the kit

Why a kit instead of just... using AI

Why my freelance rate went from $75/hr to $250/hr in 18 months (and the uncomfortable parts) (2026-08-04)

Why I wrote this

The numbers

What "the pattern" actually is

Why this works

The script

What this changes

Why I'm not worried about AI taking my freelance income (2026-08-03)

What clients pay for

What I think actually happens

The historical analogy

What I'd tell a new freelancer

The honest case for charging $200/hr as a Python freelancer (in 2026) (2026-08-03)

Why I wrote this

The numbers

What "the pattern" actually is

Why this works

The script

What this changes

`/api/headers` — $0.0005 USDC per call

`/api/redirects` — $0.0005 USDC per call