AISkills402Connect your agent

For site owners

The aiskills402-check bot

If your logs show the user agent aiskills402-check/1.0, someone paid us to check whether your x402 payment endpoint can be paid by a standard client. The bot asks your address a few questions without paying, reads the 402 answer, and gives the result to that customer. It never pays you and never sends a payment.

What it sends

The full user agent string, which we never change or hide:

aiskills402-check/1.0 (+https://aiskills402.com/docs/x402-offer-check)
  • GET and POST to the address it was given, without a payment header. The POST body is {}: many x402 sellers take payment on POST, and an unpaid POST should answer 402.
  • One CORS preflight (OPTIONS), to see whether a browser agent could read your PAYMENT-REQUIRED header.
  • Every request carries this name. If your server answers 403, the bot records it and stops there; it never retries without its name.
  • Nothing from our customer is passed on: no headers, no cookies, no body of theirs. The requests are built from scratch every time.

How much and how often

  • At most 8 requests per check, each cut off after 5 seconds, all of them after 12 seconds.
  • At most 3 redirects are followed, and each new address is vetted again before it is asked.
  • At most 64 KB of each answer is read; the rest is dropped.
  • At most 30 checks per hour against the same host, however many customers ask.
  • Only https on port 443 and DNS names. IP addresses, private names and our own hosts are refused before anything is sent.

The requests come from Cloudflare's network, the same shared addresses every Cloudflare Worker uses. Blocking those addresses blocks far more than this bot; block the user agent instead.

What we keep

The answer goes to the customer who paid for the check. We keep one log line per check with your host name, whether it was reachable and how many findings there were. We do not keep the path, the query, your answer or your headers.

How to opt out

  • Block the user agent aiskills402-check in your firewall or WAF. The bot records the refusal and does not try another way in.
  • Or write to hello@aiskills402.com with your host name, and we will exclude it from checks.

The service behind it

x402-offer-check is one of three paid diagnostics for x402 payments, next to a check of a signed PAYMENT-SIGNATURE header and a check of a receipt on Base. Only the offer check contacts other websites; the other two read what the customer sends and the Base chain. The free example, with its input schema and a recorded result, is at https://api.aiskills402.com/v1/run/x402-offer-check/example. How the checks work and what they found on listed storefronts: HTTP 402 and x402: three places a payment breaks. Paying for calls in general: pay-per-call APIs.