A payment challenge is easy to fake. Any server can return HTTP 402 with a price and a wallet address. That proves the server can produce a challenge. It does not prove that the route returns real data after the payment settles.
This is the central trust problem in the x402 market. The buyer cannot charge back an on-chain payment. The agent may not have a human watching. A listing that says "verified" without evidence is worse than a listing that says "unverified", because it borrows trust it has not earned.
What a badge should mean
A verification badge should answer a narrow question: did this named route accept a real payment and return a non-empty response at a known time?
That is it. It is not a security audit. It is not a guarantee of uptime. It is not a statement that the data is licensed for every use. It is a point-in-time record.
A good verification record includes:
- The listing and route.
- The amount and network.
- The payee in the challenge and the expected payee.
- The HTTP status after payment.
- The response time.
- The transaction hash and block number.
- The timestamp.
- The outcome: product, error, empty body or out of band.
If any of those is missing, the badge is doing less than it appears to do.
The sequence that matters
A trustworthy verification runs the same sequence a buyer would:
- Call the route without payment.
- Confirm the 402 has a readable challenge.
- Check the scheme, network, asset, amount, payee and timeout.
- Confirm the payee matches the provider's configured wallet.
- Pay one call from a verification wallet.
- Confirm the response is non-empty and successful.
- Record the settlement and the response time.
- Publish the receipt.
The important step is the payee check. A route can return a valid 402 that pays a different wallet. If the verifier does not compare the challenge payee with the provider wallet, the badge can be earned by a route that sends the money somewhere else.
What verification does not prove
A verified badge does not prove:
- That the data is accurate.
- That the provider has the right to redistribute it.
- That the route will be available tomorrow.
- That the price will stay the same.
- That the response schema is stable.
- That the provider will answer a support request.
Those are separate questions. The listing should answer them separately, with source notes, price history, uptime, schema examples and a contact.
Uptime and latency are part of trust
A single paid call proves one moment. Reliability data proves a pattern. A buyer should be able to see:
- The last check.
- The uptime over a window.
- The p50 and p95 latency.
- The error rate.
- The last paid receipt.
One failed check is not a reason to delist a route. A pattern of failures is. The listing should show both the latest state and the history, not only a green badge.
The receipt is the evidence
A receipt should link the listing, the route, the amount, the network and the transaction. It should be stable, public and easy to verify on a block explorer.
A receipt is not a marketing asset. It is a record. If the transaction does not exist, or the amount does not match, the receipt is broken. The fix is to re-run the verification, not to hide the receipt.
A buyer checklist
Before an agent pays a new route, check:
- Is the price visible before the call?
- Does the 402 pay the expected wallet?
- Is there a recent paid receipt?
- Does the response example match the real response?
- Is the route marked verified, listed or paused?
- Is there a contact for support?
- Is the data source named?
- Is the licence or usage note clear?
If the answer to any of these is no, the agent should treat the route as unverified, even if the page has a badge.
What APIStead does
APIStead runs a scheduled verification check that reads the unpaid 402, validates the challenge, checks the payee, pays one call and records the outcome. A verified route links to the settlement. The badge covers one route, not the whole listing.
The current catalogue is small on purpose. A verified route with a public receipt is more useful than a large directory with no evidence.
Trust is not a badge. It is the ability to check the claim.