DEV Community: ScrapeMole

Your x402 endpoint settles but isn't in the Bazaar? The buyer's client decides (and a no-money fix)

ScrapeMole — Mon, 12 Oct 2026 08:49:25 +0000

Disclosure: I run ScrapeMole, a small set of pay-per-call x402 APIs. This post is about a discovery bug we hit in our own setup; the fix works for any x402 seller.

The symptom

Our endpoints had been live on Base mainnet for about a day. Real outside wallets had paid for 18 calls, every one settled through the PayAI facilitator, and every 402 response carried a valid extensions.bazaar declaration.

Yet when we queried the facilitator's public catalog for our receive address:

curl "https://facilitator.payai.network/discovery/resources?payTo=0xYOUR_PAY_TO&limit=100"
# {"items":[], "pagination":{"total":0}}

Zero. Meanwhile our testnet endpoints were in the catalog.

Why: the catalog indexes what the buyer echoes, not what you serve

Bazaar-style catalogs (PayAI's, and per the x402 spec, any facilitator's) don't crawl your 402 response. They read the discovery declaration from the payment payload that arrives at /verify or /settle. In x402 v2 the buyer's client is supposed to copy extensions (and resource) from your 402 into that payload.

Many buyer clients don't. So you can have plenty of real settlements and still never be catalogued. Our testnet endpoints were listed only because our own e2e test client used the official @x402/fetch wrapper, which does echo the extension.

PayAI's docs say this outright: a successful settlement alone does not list a resource; the payload has to carry the bazaar extension. Their /verify and /settle now return an EXTENSION-RESPONSES header so you can tell what happened:

header	meaning
`{"bazaar":{"status":"processing"}}`	received, queued for cataloging
`{"bazaar":{"status":"rejected",...}}`	received, failed validation
no header	the payload had no bazaar extension

The fix (no money moves)

You only need one payload with the extension to reach the facilitator, and /verify is enough. For a GET resource, the catalog admits it when its own read-only probe of your URL gets a 402 back.

So: sign a payment from your own receive wallet to itself (net zero even if it were ever settled), attach the bazaar extension from your live 402, and send it to /verify only, never /settle.

import { privateKeyToAccount } from 'viem/accounts';
import { x402Client } from '@x402/core/client';
import { ExactEvmScheme } from '@x402/evm';

const acct = privateKeyToAccount(process.env.PAY_TO_KEY);   // your receive wallet
const client = new x402Client().register('eip155:8453', new ExactEvmScheme(acct));

for (const url of process.argv.slice(2)) {
  const r = await fetch(url);                                // unpaid -> 402
  const pr = JSON.parse(Buffer.from(r.headers.get('payment-required'), 'base64'));
  const payload = await client.createPaymentPayload(pr);
  payload.extensions ??= { bazaar: pr.extensions.bazaar };   // make sure it's echoed
  payload.resource ??= pr.resource;
  const v = await fetch('https://facilitator.payai.network/verify', {
    method: 'POST', headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ x402Version: 2, paymentPayload: payload, paymentRequirements: payload.accepted ?? pr.accepts[0] }),
  });
  const ext = v.headers.get('extension-responses');
  console.log(v.status, url, ext && Buffer.from(ext, 'base64').toString());
}

The wallet needs a USDC balance at least the price for /verify to report isValid: true. Nothing is transferred, because we never call /settle.

We ran it over our 40 mainnet GET endpoints. Every one came back {"bazaar":{"status":"processing"}}, and about a minute later the catalog query above returned total: 40.

Things worth checking on your own service

Query /discovery/resources?payTo=<your address> on every facilitator you settle through. Don't assume settlements mean you're listed.
Look for the EXTENSION-RESPONSES header in your own test runs. If it's missing, your client isn't echoing extensions.
Each facilitator has its own catalog. Being in PayAI's says nothing about Coinbase CDP's Bazaar, which only sees payloads settled through CDP.
Re-run the verify step when you add endpoints. New routes won't show up until some payload carrying their declaration reaches the facilitator.

A note on who's buying

When we looked at the two wallets that paid us (wallet activity is public on Basescan), both also paid several other x402 sellers in the same minutes, mostly through the Coinbase facilitator. One wallet had funded the other directly, so it's most likely a single operator running a research agent across many paid APIs. The lesson for us: buyers shop across catalogs, so being missing from one catalog is lost sales, not a cosmetic gap.

If you sell x402 APIs and have hit other discovery gotchas, I'd like to hear them in the comments.

What AI agents actually paid for in our first day of selling x402 APIs ($0.175, 18 calls, 2 wallets)

ScrapeMole — Mon, 12 Oct 2026 07:46:48 +0000

Disclosure: I'm the maker of ScrapeMole, the API this post is about. Every number below comes from our own Cloudflare logs and the public Base blockchain.

Yesterday we put a set of pay-per-call APIs online for AI agents. There are no accounts and no API keys: an agent calls an endpoint, gets HTTP 402 Payment Required with a price, pays with a signed USDC authorization over x402, and gets the data. (The build itself is in the previous post.)

About 20 hours after launch, here's what agents actually paid for, what they only looked at, and what we changed because of it.

The numbers so far

Revenue: $0.175 USDC, settled on Base to our receive address.
18 paid calls from 2 different wallets. Neither wallet is ours.
What they bought: YouTube search 16 times, YouTube channel lookup once, a YouTube transcript once. Every paid call was a $0.005 or $0.01 endpoint.
What nobody has paid for yet: the 25 endpoints we added last night (web reader, DNS/WHOIS, onchain prices, SEC company data, Wikipedia). They're less than a day old.

$0.175 isn't a business. But it shows the loop working: real agents found the API through directories with no human in between, paid, and came back.

Lesson 1: being listed early mattered more than the product itself

The paid calls all went to the origin that had been listed the longest: our first worker, registered on x402scan, x402dash, Agent402 and 402 Index about 8 hours before the others. Wikipedia lookups or DNS records aren't less useful than YouTube search. Agents just hadn't seen them yet.

So the first rule of selling to agents seems to be the same as selling to people: be where they look, and be there early. We now list every new endpoint on four x402 directories and the official MCP Registry within the hour.

Lesson 2: one agent doing a task is worth more than many browsing

One wallet made 15 calls in 13 minutes, all to the same search endpoint with different queries. That looks like an agent working through a research task in a loop, not someone kicking the tires. A tool that's cheap, fast and predictable inside a loop gets reused.

That's why we keep prices at $0.001 to $0.01 and settle only when the response is a 200. If the upstream fails, times out or the input is bad, the agent pays nothing. An agent (or the person who set its budget) can't easily tell a bad result from a bad tool, so we take that risk instead of the agent.

Lesson 3: discovery traffic dwarfs paid traffic

Across our seven origins, Cloudflare's logs show about 6,100 requests since launch against 18 paid calls, so roughly 340 free requests for every paid one. Most of it is automated discovery and monitoring:

roughly 10 to 12 unpaid 402 probes per endpoint on the new origins in their first night. That's directories and crawlers checking the price and payment details;
about 2,800 POSTs to the remote MCP endpoints (/mcp), 300+ per origin, from MCP indexes and clients connecting and listing tools. None of them has turned into a paid tool call yet;
about 740 fetches of openapi.json and 200 of llms.txt, plus a steady trickle of POST/PUT/DELETE guesses at the paid routes. Agents and scanners probing what the API accepts.

The takeaway: your machine-readable surfaces (OpenAPI, the 402 body, MCP tool descriptions) are your storefront. Write them for a model that decides in one pass whether your tool fits its task. Say when to use the tool, not only what it returns.

What we shipped because of this: ScrapeMole Pulse

Language models are frozen in time. They don't know today's date in Tokyo, this morning's EUR/USD rate, or whether it'll rain in Vilnius tomorrow. Those are small, boring, constant needs, which makes them a good fit for pay-per-call. So today we launched ScrapeMole Pulse:

Endpoint	What it returns	Price
`/v1/fx/latest`	ECB reference rates for ~30 currencies, any base	$0.001
`/v1/fx/convert`	Convert an amount at the latest or a historical ECB rate (since 1999)	$0.001
`/v1/fx/history`	Daily rate series up to a year, with min/max/change	$0.002
`/v1/time/now`	Current local time, offset and DST in up to 20 time zones	$0.001
`/v1/time/convert`	DST-aware conversion for scheduling ("15:00 New York" in Vilnius and Tokyo)	$0.001
`/v1/weather`	MET Norway forecast by coordinates or place name: now, hourly, 9 days	$0.002
`/v1/news/hn`	Hacker News top/new/best/ask/show lists with points and comments	$0.002

Every response names its source and licence: ECB data via the open-source Frankfurter API, weather from MET Norway (CC BY 4.0), place names resolved through Wikidata (CC0), and the official Hacker News API (we leave out usernames). Time-zone math runs on the IANA tz database built into the runtime, so it has no upstream to fail.

Before going live, Pulse passed a paid end-to-end test on Base Sepolia: 19 of 19 checks, $0.010 spent by the test buyer and $0.010 received, and $0 charged for the three calls designed to fail.

The full lineup

All on the Cloudflare Workers free plan, all with openapi.json, llms.txt and a remote MCP server at /mcp:

YouTube + Google Trends: search, channels, transcripts, interest over time — https://scrapemole-api-mainnet.scrapemole.workers.dev
Reader: any page as Markdown, link previews, RSS feeds, links, sitemaps — https://reader.scrapemole.workers.dev
Domains: DNS, RDAP/WHOIS, availability, email security, SSL, subdomains — https://domains.scrapemole.workers.dev
Onchain: Base/Ethereum prices, DEX prices, ENS/Basenames, gas, balances, transactions — https://onchain.scrapemole.workers.dev
Companies: SEC EDGAR profiles, XBRL financials, filings — https://companies.scrapemole.workers.dev
Wiki: Wikipedia summaries and search, Wikidata facts (attributed) — https://wiki.scrapemole.workers.dev
Pulse: FX, time zones, weather, Hacker News — https://pulse.scrapemole.workers.dev

Try one from the terminal without paying. You'll get the 402 with the exact price:

curl -i "https://pulse.scrapemole.workers.dev/v1/fx/convert?from=USD&to=EUR&amount=250"

Then retry with any x402 client (for example @x402/fetch) to pay and get the result.

What's next

Our 30-day goal is modest and public: at least 3 different paying wallets and $100 in total. We're at 2 wallets and $0.175. Next up are more listings for the new origins and Solana USDC as a second payment network (code is done and tested on devnet). We'll keep adding small tools in the categories agents actually pay for.

If you're building agents and want a data source we don't have, say so in the comments. If it's public, non-personal data and we can serve it reliably, we'll build it.

How we built a pay-per-call x402 API on the Cloudflare Workers free plan (and only charge on success)

ScrapeMole — Sun, 11 Oct 2026 18:51:23 +0000

Disclosure: I'm the maker of ScrapeMole, the API this post is about. All the numbers below come from our own test reports. There are no paying users yet.

AI agents are good at finding tools and bad at signing up for them. An agent can read an OpenAPI spec in milliseconds, but it can't open an account, confirm an email and paste an API key without a human. x402 skips that step: the server answers HTTP 402 Payment Required with a price, the client pays with a signed stablecoin authorization in a header, and gets the response.

ScrapeMole is a test of that idea: a few public web data endpoints (YouTube search, channel videos, transcripts, Google Trends, Amazon product pages) at $0.005 to $0.01 per call, paid in USDC on Base. This post covers how it works, how it runs on Cloudflare's free plan, and the problems we hit along the way.

The payment flow

Call any paid endpoint without paying:

curl -i "https://scrapemole-api-mainnet.scrapemole.workers.dev/v1/youtube/search?q=espresso"

HTTP/2 402
payment-required: eyJ4NDAyVmVyc2lvbiI6Mi...   (base64 of the JSON below)

{
  "x402Version": 2,
  "accepts": [{
    "scheme": "exact",
    "network": "eip155:8453",
    "amount": "10000",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "payTo": "0xCb535d13C7fC5Fe6C2B88da3f3601B840CCaf8Bc",
    "maxTimeoutSeconds": 300
  }]
}

(Trimmed: the real response also has a resource description and a Bazaar discovery extension with the input schema and an example output.)

amount is in USDC base units (6 decimals), so 10000 is $0.01. The client signs an EIP-3009 transferWithAuthorization for exactly that amount and retries with a PAYMENT-SIGNATURE header. With @x402/fetch it's a wrapper around fetch:

import { wrapFetchWithPaymentFromConfig } from '@x402/fetch';
import { ExactEvmScheme } from '@x402/evm';
import { privateKeyToAccount } from 'viem/accounts';

const account = privateKeyToAccount(process.env.AGENT_PRIVATE_KEY); // a wallet with a little USDC on Base
const pay = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [{ network: 'eip155:8453', client: new ExactEvmScheme(account) }],
});

const res = await pay('https://scrapemole-api-mainnet.scrapemole.workers.dev/v1/youtube/search?q=espresso&limit=10');
console.log(res.status, await res.json());

The buyer pays no gas: the facilitator submits the authorization on-chain.

"Failed calls are free" has to be enforced, not promised

This was the property we cared about most. A scraping API fails for reasons the caller can't control: the video has no captions, the channel doesn't exist, the source rate-limits you. Charging for those calls would make agents avoid us.

The x402 flow makes this simple to enforce. The server sends the payment to the facilitator (we use PayAI) for verification before doing any work, and requests settlement only after the handler has returned a 200. Every other status is a JSON error with "charged": false, and the authorization is never settled:

Status	Code	Meaning
400	`INVALID_INPUT`	Missing or malformed parameter
404	`NOT_FOUND` / `NO_DATA`	Target doesn't exist, or has nothing to return
503	`BLOCKED`	The source rate-limited us even after retries
502/504	upstream error / timeout	Try again

We test this end to end on Base Sepolia with throwaway wallets, comparing on-chain USDC balances before and after the run. The latest run passed 13/13 checks: four unpaid calls got correct 402s, four paid calls returned data, four deliberately failing paid calls (unknown video, unknown channel, missing query, impossible time range) returned errors, and the route we had disabled was confirmed to be absent. The buyer's balance went down by exactly $0.035, the sum of the four successful calls. The failing calls cost $0.

If you build something similar, put the balance check in your test. It's the only way to be sure that "not charged" really holds.

Running on the Cloudflare Workers free plan

The free plan gives you roughly 10 ms of CPU per request (network wait time doesn't count) and 100k requests a day. For endpoints that call a JSON API and reshape the result, like YouTube's internal API and Google Trends, 10 ms was enough. Three things needed work.

1. Egress regions get bot-checked differently

Datacenter IPs get bot-checked, and Cloudflare's are no exception. What surprised us was how much it depended on where the Worker ran. On our first live probe from Workers, YouTube transcripts succeeded 1 time in 5 and Google Trends 0 in 5.

What fixed it: when a run comes back BLOCKED, re-run it inside a Durable Object created with a locationHint, which places it, and its outbound requests, in another region.

for (const hint of ['weur', 'eeur', 'sam']) {
  const stub = env.SCRAPER.get(env.SCRAPER.idFromName(`relay-${hint}`), { locationHint: hint });
  const r = await (await stub.fetch('https://relay/run', {
    method: 'POST', body: JSON.stringify({ id, input }),
  })).json();
  if (!isBlocked(r.items)) return r.items;
}

In our tests, Western Europe, Eastern Europe and South America passed where the other locations were blocked. With the retry, the next probes passed 10/10 for transcripts and 10/10 for Google Trends. YouTube search and channel listings never needed it (5/5 each). It uses no proxies, and since the retry only runs when the first try was blocked, it costs nothing in the normal case.

This is not a guarantee: the blocking is the source's decision and can change at any time. That's one more reason a blocked call must never be charged.

2. Some parsing simply doesn't fit in 10 ms

Parsing a full Amazon product page with cheerio went over the CPU limit. Rather than pay for a plan, that one endpoint runs on a Vercel function. The Worker links to it from its / and llms.txt, so agents still find it.

3. Don't share in-flight I/O across requests

The x402 server middleware syncs with the facilitator (GET /supported) when it initializes. If that happens during one request and a second request waits on the same promise, workerd refuses: a Worker can't await I/O that another request started. Our fix: build everything that doesn't need I/O (routes, discovery schemas) at startup, initialize inside the first paid request, and cache it only after it succeeds. If the facilitator is unreachable, the call returns a 503 (not charged) and the next request tries again.

Discovery: there's no app store

Agents only find you if you publish machine-readable metadata. We serve:

openapi.json, with an x-payment-info block (price, network, asset) on every paid operation
/.well-known/x402, plus the Bazaar discovery extension inside every 402 (input schema and an example output)
llms.txt, a plain-text guide for LLMs

One compatibility note: x402 v2 puts the payment challenge only in the PAYMENT-REQUIRED header, and some indexers built for v1 still read accepts from the body. We copy the decoded challenge into the body as well, and one indexer that had rejected us accepted the listing after that.

Several x402 directories (x402scan, x402dash, Agent402, 402 Index) accepted our listing with one API call each, with no account.

The same tools over MCP

There's also a remote MCP server at /mcp (Streamable HTTP, stateless) using the x402 MCP transport:

curl -s https://scrapemole-api-mainnet.scrapemole.workers.dev/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

tools/list is free. An unpaid tools/call returns isError: true with the same PaymentRequired object in structuredContent. The client retries with the signed payment in params._meta["x402/payment"], and the settlement receipt comes back in result._meta["x402/payment-response"].

Internally, each MCP tool just calls the matching HTTP route with a PAYMENT-SIGNATURE header, so there's one verify/settle code path for both interfaces. The MCP version of the testnet test passed 9/9: one paid search settled at exactly $0.01, and a paid call with invalid input returned INVALID_INPUT without settling. The server is in the official MCP Registry as dev.pages.scrapemole/scrapemole; the registry accepted proof of domain ownership through a file on our site, with no GitHub account needed.

What it costs to run

Nothing so far. Workers, Durable Objects, cron monitoring and the website are on Cloudflare's free tiers, and Amazon runs on a Vercel free function. PayAI's facilitator also has a free allowance for settlements, and the buyer pays no gas.

Open questions

Will agent builders actually pay per call? It's live on Base mainnet, but no one has paid yet. Prepaid credits with an API key might still be easier for teams.
How long will the regional retry work? I expect to keep measuring it with the cron canary that runs every 30 minutes.
What should come next? If there's a source you'd want behind a 402, I'd like to hear it.

Docs, prices and live test numbers: scrapemole.pages.dev. The API's openapi.json and llms.txt are linked there.