How to List Your x402 API on 402 Index, x402scan and Bazaar

Search engines are not how an AI agent finds a paid API. Agents look in directories that publish machine-readable catalogs: endpoint, price, network, example body. Three of those take a few minutes each and need no account. Here is what we did for an API with eight paid endpoints, in the order that worked.

Step 0: make the 402 itself self-describing

Directories probe your endpoint, so the challenge has to be clean. Check these first:

• Every paid route answers 402 with a base64 PAYMENT-REQUIRED header (decode it and read it yourself).
• The paywall runs before your body validation, so even a probe with an empty body gets the 402. Some gateways validate the body first and answer 400 to the directory's checker. If that is you, keep an example body that passes validation and hand it to the directory as probe_body.
• The 402 carries extensions.bazaar with an example input and output (shape below).
• You publish /openapi.json with a payment hint per operation, and /.well-known/x402 with the list of paid URLs.

The hint in OpenAPI is a vendor extension on each operation:

"/v1/embed": {
  "post": {
    "summary": "Multilingual text embeddings (BGE-M3, 1024 dimensions)",
    "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "texts": { "type": "array", "items": { "type": "string" } } }, "required": ["texts"] } } } },
    "responses": { "200": { "description": "Result (after payment)" }, "402": { "description": "Payment required (x402 v2): see the PAYMENT-REQUIRED header" } },
    "x-payment-info": { "price": { "mode": "fixed", "currency": "USD", "amount": "0.001" }, "protocols": ["x402"] }
  }
}

And the discovery extension that goes inside the 402 challenge:

"extensions": {
  "bazaar": {
    "info": {
      "input":  { "type": "http", "method": "POST", "bodyType": "json", "body": { "texts": ["hello world"] } },
      "output": { "type": "json", "example": { "model": "bge-m3", "dimensions": 1024, "count": 1 } }
    },
    "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object",
      "properties": { "input": { "type": "object" }, "output": { "type": "object" } }, "required": ["input"] }
  }
}

Step 1: 402 Index

402 Index is an open directory of paid APIs (x402, L402 and MPP) with search, hourly health checks and a public API. Registering is one request per endpoint:

curl -X POST https://402index.io/api/v1/register -H 'content-type: application/json' -d '{
  "url": "https://your-worker.workers.dev/v1/embed",
  "name": "Your Studio: Multilingual embeddings",
  "protocol": "x402",
  "http_method": "POST",
  "probe_body": "{\"texts\":[\"hello world\"]}",
  "description": "Multilingual text embeddings (BGE-M3, 1024 dimensions). Pay per call in USDC on Base via x402.",
  "price_usd": 0.001,
  "payment_asset": "USDC",
  "payment_network": "Base",
  "category": "ai",
  "provider": "Your Studio"
}'

201 means accepted. 422 means the probe did not get a valid 402 (the response says what it saw), and probe_body is how you tell the checker what to send to endpoints that validate the body before the paywall. The limit is ten registrations per hour per IP, and registering the same URL again updates the record.

Verify the domain. This is the step that turns "pending review" into "approved". You ask for a claim token for your domain, serve the hash you receive as plain text at /.well-known/402index-verify.txt, then call the verify endpoint. After we did this, the four listings that were pending were approved at once, and every later registration came back with "status": "active". Domain verification also ranks verified services first in search results.

Check your listings with the public API: GET https://402index.io/api/v1/services?q=your+name&protocol=x402. You will see health_status, probe_status and, after the next hourly probe, the payment-valid flags.

Step 2: x402scan

x402scan is an explorer of x402 resources. It reads your /openapi.json, so Step 0 pays off here. Its public tRPC endpoint registers every resource in your OpenAPI file from the origin, with no wallet and no login:

curl -X POST https://www.x402scan.com/api/trpc/public.resources.registerFromOrigin \
  -H 'content-type: application/json' -d '{"json":{"origin":"https://your-worker.workers.dev"}}'

Our response said "registered": 8, "failed": 0, "source": "openapi". Re-run it whenever you add routes. The optional "verified" badge needs the payTo wallet to sign your origin URL and the proof to be published in x-discovery.ownershipProofs in the OpenAPI file. Only the wallet owner can produce it, so it is a deliberate extra step.

Step 3: the PayAI Bazaar (needs one real payment)

The Bazaar is the catalog that agent frameworks query. There is no sign-up form: a resource is cataloged as a side effect of a settled payment through a facilitator that supports discovery, provided the 402 carried the bazaar extension. You can browse what is listed at https://facilitator.payai.network/discovery/resources.

So the last step is to pay your own endpoint once. Fund a throwaway wallet with a few cents of USDC on Base, run the client from How an AI Agent Pays an x402 API against your cheapest route, and the settled payment puts the service in the catalog. We have not completed this step yet, because our first real payment has not happened, which is the honest state of a new API.

A checklist you can paste

1. Each paid route returns a valid 402 and extensions.bazaar.
2. /openapi.json has x-payment-info on each paid operation; /.well-known/x402 lists the URLs.
3. Register every endpoint on 402 Index with a probe_body for POST routes.
4. Claim and verify the domain on 402 Index.
5. Call x402scan's registerFromOrigin.
6. Make one real payment to get into the Bazaar.
7. Do not change prices or response shapes casually: 402 Index re-checks about every hour.

The service behind these examples is documented on its API page, and the server-side code is in How to Add x402 Payments to a Cloudflare Worker with Hono.

FAQ

Do I need an account to list an API on 402 Index?

Not as of October 2026. You register with one HTTP request, the endpoint is probed to confirm it returns a valid 402, and verifying your domain gets listings approved automatically.

Why is my API not in the Bazaar yet?

The PayAI Bazaar catalogs a resource as a side effect of a first settled payment through that facilitator, and the 402 response must carry the bazaar extension. Until someone pays once, the resource is not listed there.

What does the x402scan verified badge need?

An ownership proof: the payTo wallet signs your origin URL, and the signature is published in the x-discovery.ownershipProofs field of your OpenAPI document. Registration itself needs no wallet.

How often are listings re-checked?

402 Index runs automated health checks about hourly, so a broken challenge or a changed price shows up quickly. Keep the 402 stable.