How I Added x402 Micropayments to a Zero-Log File-Sharing API (and Verified Every Cent On-Chain)

Skuuy — Tue, 13 Oct 2026 02:56:24 +0000

I took Skuuy — a free, privacy-first toolkit with 15 MCP tools, an ephemeral file drop, and a URL→markdown reader — and put three endpoints behind x402 v2 micropayments: $0.005 USDC per request on Base. No signup, no API keys, no sessions. Real payments are settling on-chain today, the services are indexed on Agentic.market, and I'm going to be honest with you about the revenue: it's currently ~$0/month, and that's fine.

The problem: agents can't sign up for things

I build infrastructure for AI agents. My MCP server gives agents 15 tools — DNS lookups, temp inboxes, webhook inspectors, port checks, a URL reader that strips pages down to clean markdown. All free, no API keys. That's the discovery funnel.

But some endpoints have real marginal cost and real abuse surface: file uploads (storage, bandwidth), paste (spam), and the reader (compute, target-site load). Traditional monetization — Stripe, API keys, dashboards — is a non-starter for agents. An agent can't create an account, can't type a credit card number, can't do an OAuth dance.

x402 solves this cleanly. The protocol resurrects HTTP 402 "Payment Required": the server responds with machine-readable payment terms, the client settles in stablecoins, and the request completes. The agent pays $0.005 and moves on. No humans in the loop.

What I actually built

Three paid endpoints, all on Base (eip155:8453), scheme exact, denominated in USDC:

Endpoint	Price	Free tier
`POST file.skuuy.com/drop`	$0.005	25/day/IP
`POST file.skuuy.com/paste`	$0.005	25/day/IP
`GET read.skuuy.com/read?url=`	$0.005	100/day/IP

Everything else — the other 11 MCP tools, the MCP server itself — stays free forever. MCP clients aren't x402-aware anyway, so paywalling them would just break things.

The design principles:

Freemium, not gated. Free quota first, 402 only after exhaustion. Agents get real utility before ever paying.
Charge only on HTTP 200. If my server errors, the client doesn't pay. Obvious in retrospect, easy to get wrong.
Zero-log privacy preserved. The file drop is burn-after-reading with TTLs (15m–7d), R2 storage with prefix-per-TTL lifecycle rules, and no request logging. Adding payments didn't add surveillance — settlement happens on-chain, between the payer's wallet and mine.
MCP stays free. The MCP tools are the funnel. Payment lives only on the REST endpoints.

The implementation

Stack: Cloudflare Workers/Pages, Cloudflare R2 for storage, Coinbase CDP as the x402 facilitator.

The 402 response follows the x402 v2 standard — x402Version, resource, accepts with the payment terms, and extensions. Two extensions matter here:

Bazaar extension — makes the endpoint discoverable by agents browsing the Bazaar catalog:

"extensions": {
  "bazaar": {
    "discoverable": true,
    "description": "Use this when you need to share a file with an agent: uploads any file up to 10MB, returns a one-time download link. Burn-after-reading, zero-log.",
    "inputSchema": { ... },
    "outputSchema": { ... }
  }
}

This is what gets the service indexed on Agentic.market. Both my services are live there today — file.skuuy.com and read.skuuy.com, each at $0.005.

Builder Code extension — on-chain attribution so Base's dashboard credits my project for the x402 volume it generates:

import { declareBuilderCodeExtension } from '@x402/extensions';

const extensions = {
  ...buildBazaarExtensionForRoute(spec),
  [BUILDER_CODE]: declareBuilderCodeExtension('bc_c61pqqgo')
};

One code across all my resource servers. Settlement calldata carries it, and the dashboard aggregates. (The code itself is claimed at base.dev — it's an ERC-721 in a registry contract, first-come-first-served. Claim your name early.)

One gotcha that cost me an hour: the facilitator credentials. My first live payment test returned 401 — the fix was setting CDP_API_KEY_SECRET in Cloudflare Pages Production environment and redeploying. The Preview env had it; Production didn't. Check both.

Verified, not vibes

I don't trust "it works on my machine" for money. Every claim above was verified independently:

Real on-chain settlements — two live $0.005 USDC payments, confirmed via Base RPC with Transfer events:

File drop: 0x7010035d…992e → block 52532190 ✅
Reader: 0x6e6ae167…3c09 → block 52534114 ✅

Both: 5000 atomic USDC units, payer → my wallet, status success.

402 challenge format — probed live: standard x402 v2 payload with both bazaar and builder-code extensions present.

Free tier — fresh requests return HTTP 200 with X-Quota-Limit: 100 and a decrementing X-Quota-Remaining. Clean markdown body, XSS-sanitized.

Agentic.market — api.agentic.market/v1/services/search?q=skuuy returns both services with correct pricing metadata.

Hard lessons

1. IPv6 rotation defeats per-IP quota. During testing I found that IPv6 privacy extensions rotate addresses, so a single abuser looks like many IPs. The fix: bucket quota by /64 prefix, and let paid users identify by wallet instead of IP. If you're doing per-IP rate limiting in 2026, you're doing per-/64 or you're doing nothing.

2. The Agentic.market validator will say "No x402 Setup Detected" — and that's correct. The validator sends an unpaid probe and expects a 402. My freemium design returns 201 for the first 25 requests, so it never sees a 402. This is by design, not a bug. The listing flows through the Bazaar auto-index instead (status processing → live). Don't contort your product to please a validator.

3. Facilitator discovery lags the real world. Coinbase's /discovery/resources endpoint didn't show my services even after Agentic.market had indexed them. Async cataloging is normal; verify at the layer your users actually use.

4. Test with real money, early. The 401-from-missing-env-var bug only surfaced on a real payment attempt. Testnet wouldn't have caught the Production/Preview env split. $0.005 is cheap tuition.

The honest revenue section

Let me save you the hopium: realistic first-six-months revenue is $0 to tens of dollars per month. Worldwide agentic x402 volume is measured in thousands of dollars per month total (TRM Labs, 2026). Nobody is getting rich selling $0.005 API calls to agents yet.

x402 is a cashier, not a product. It doesn't generate demand — it just removes the payment friction for demand that already exists. The playbook is: build something agents desperately need (a reliable reader, ephemeral file sharing, temp mail), make it trivially discoverable (Bazaar, Agentic.market, MCP registries), keep the free tier generous enough to build habits, and let the paid tier exist for the day volume arrives.

I'm not optimizing for revenue right now. I'm optimizing for solidity — the MCP server passes 15/15 regression checks, the 402 flow is verified end-to-end on-chain, and the privacy guarantees survived the addition of payments. Revenue is a lagging indicator of usefulness.

What's next

The skuuy-mcp repo (15 tools, TypeScript) is public — PRs and issues welcome.
Community directories: x402scan, x402-list, and the x402 Foundation docs.
Grant applications (CDP micro-grants, Base Batches) with real on-chain evidence instead of slideware.
Screenshot API: same facilitator integration, $0.005/shot.

If you're building for the agentic economy, my DMs are open. And if you run an agent — the reader is free for your first 100 pages today.

Built with Cloudflare Workers, R2, x402 v2, and USDC on Base. Verified on-chain, not on vibes.

DEV Community: Skuuy