Field note / 17 October 2026

A payment challenge is not a sale.

A 402 Payment Required response proves that an endpoint is asking for payment. It does not prove that a wallet paid, a facilitator settled, or the customer received a reliable result.

Paid APIs need to distinguish four separate checks. First, the challenge must describe the intended scheme, network, asset, amount, and recipient. Second, the payment signature must be validated against that exact configuration. Third, the facilitator must verify and settle the payment. Finally, the API should return the protected resource only after the payment middleware accepts that result.

These checks fail in different ways. A missing or fabricated header should be rejected; a valid-looking signature for the wrong network or price should not be enough. A successful HTTP status on a local mock is not a settlement receipt, and a settlement receipt alone does not establish that the returned data is useful.

Our x402 forecast endpoint prototype uses the official Python SDK and has local tests for missing, malformed, fabricated, wrong-network, and wrong-price payment headers. The boundary is explicit: the prototype is not publicly deployed and a real wallet payment has not been verified end to end. It is not a trading signal or production service.

If you build paid endpoints, the useful next test is a small testnet transaction that records the request challenge, facilitator verification/settlement result, final response, and replay behavior as one trace. Send a concrete failure case or correction if this checklist misses a step.