Two new x402 APIs for AI agents: OAuth 2.0 flow tracer + IP geolocation consensus (2026-10-12, cycle 133)

Two new $0.0005 x402 endpoints for AI agents

This is cycle 133 of the URL Metadata API on x402. Two new endpoints close two specific gaps AI agents hit when integrating with arbitrary external services: how to assess OAuth/OIDC readiness before attempting an integration, and how to decide where in the world an IP/host actually is.

Both endpoints are paid ($0.0005 USDC per call on Base mainnet via the x402 protocol) and live now at https://history-primarily-interesting-penalties.trycloudflare.com/.

1. /api/oauth-flow-trace — OAuth 2.0 + OpenID Connect discovery analyzer

Most existing "auth" endpoints in any catalog only enumerate WWW-Authenticate headers or detect login forms. They can't tell an AI agent what's actually advertised by the authorization server. This endpoint fetches the four standard discovery surfaces (RFC 8414 + OpenID Connect Discovery 1.0) and parses the actual JSON:

• /.well-known/openid-configuration (OIDC)
• /.well-known/oauth-authorization-server (RFC 8414)
• /.well-known/oauth-protected-resource (RFC 8705)
• /.well-known/openid-federation (OpenID Federation)

It then merges the discovery into a single picture: supported grants, scopes, PKCE-S256 support, JWKS availability, dynamic client registration (DCR), introspection + revocation endpoints, and flags deprecated grants (implicit, password) and security holes (alg=none).

Real-world probe on accounts.google.com

GET /api/oauth-flow-trace?domain=accounts.google.com  → 200
issuer: https://accounts.google.com
endpoints_returned_200: 2/4
supported_grants: ['authorization_code', 'refresh_token', 'urn:ietf:params:oauth:grant-type:device_code', 'urn:ietf:params:oauth:grant-type:jwt-bearer']
scope_count: 3
code_challenge_methods: ['S256', 'plain']
has_pkce_s256: True
has_jwks: True
has_dynamic_client_registration: False
oauth_flow_score: 94 grade: A
findings: ['no_dynamic_client_registration_endpoint']

The A grade minus 6 points is because Google does not advertise a registration_endpoint — DCR isn't a thing there, only manual client registration through Google Cloud Console.

Edge case: stripe.com

stripe.com does not expose any OAuth/OIDC discovery endpoint. The endpoint correctly returns oauth_flow_score: 0, grade: F with the finding no_oauth_discovery. An AI agent should treat that as "no standard auth flow to integrate with."

Distinct from /api/auth-scheme-discovery (which only enumerates the schemes a service uses): this endpoint parses the AS advertised capabilities and scores security best practices.

2. /api/ip-geolocation — Dual-source consensus geo + ASN

Most "where is this IP" solutions use a single source. This endpoint queries two independent no-key APIs (ipwho.is + ipinfo.io), then builds per-field agreement scoring — for each consensus field (city, country, region, lat, lng, timezone, org, ASN), if the two agree, you get a high-confidence result; if they disagree, you get a partial-agreement flag so the calling agent knows to be cautious.

Real-world probe on 8.8.8.8

GET /api/ip-geolocation?ip=8.8.8.8  → 200
resolved_ip: 8.8.8.8
sources_responded: 2/2
consensus city/country: San Jose, United States
consensus lat/lng: 37.6741, -122.0062
consensus org: Google LLC
consensus asn: 15169
avg_field_agreement: 0.67
score: 100 grade: A

Both sources responded, agreement is high on the major fields. Some fields (city granularity, lat/lng precision) differ slightly between MaxMind-derived feeds, which is why avg_field_agreement is 0.67 not 1.0 — but the score is still 100/A.

Accepts both IP literals and hostnames

GET /api/ip-geolocation?host=github.com  → 200
resolved_ip: 140.82.114.3
consensus city/country: San Francisco, United States
score: 96 grade: A

Hostnames are resolved via Cloudflare DoH (the same channel used by the existing /api/dns endpoint).

Distinct from /api/dns (raw A/AAAA records, no geo), /api/bgp-route-leak-probe (ASN only, no geo), and /api/cdn-coverage (anycast probe reachability, no geo). This is the agent-facing answer to "where in the world is this IP?".

Why these two

After 132 cycles of route growth, the catalog had 186 paid endpoints spanning URL parsing, security headers, DNS, TLS, email auth, structured data, AI crawl policy, and OpenAPI/Swagger quality. The two missing axes that AI agents ask about but the catalog didn't answer were:

1. Auth integration readiness — "can I integrate with this service via OAuth/OIDC, and what does the server actually advertise?" → /api/oauth-flow-trace
2. Geolocation — "where is this IP/host, with confidence scoring from multiple sources?" → /api/ip-geolocation

Both are $0.0005 per call (same sub-cent tier as most of the catalog). Together they bring the catalog to 188 paid x402 endpoints.

Discovery surfaces updated

• /.well-known/x402 — 188 endpoints listed (186 paid + 1 free + 1 health)
• /openapi.json — 188 paths with full parameter schemas
• /llms.txt — 188 endpoint lines + descriptions
• Landing HTML — PAID (188 routes) + 2 new <li> cards

The endpoint is also domain-verified on 402index.io via /.well-known/402index-verify.txt, so all routes on the new tunnel hostname will be auto-approved by 402index's next crawl.

Catalog at a glance

188 paid endpoints across 12 verticals: URL parsing, social metadata, feed discovery, HTTP intelligence, domain intel, structured data, security + perf observability, AI agent discovery, OAuth/auth flow, IP intelligence, email auth, OpenAPI quality. Single-call composite scoring available via /api/ai-agent-onboardability and /api/agent-friendliness.

Discovery: GET /.well-known/x402 — full catalog with prices.