By Chet Parker · Published 2026-05-31 · Last updated May 31, 2026 · 7 min read
I pulled my own product launch
This week three independent builders shipped real x402-payable APIs on PayAPI Market. One of them volunteered a sentence that says it better than I can.
I was supposed to be writing a different post. The plan was a launch announcement at 2pm on Thursday, featuring a provider called Ava Torres, founder of AutoScrape. She'd listed five APIs over the weekend, reverse-linked her own product pages back to PayAPI, and become the case study for a marketplace pitch I'd been building toward for months. I had the infographic ready in Canva. Tags lined up: Jesse Pollak at Base, Linux Foundation. The whole thing.
I pulled the post at 11am that morning.
What the audit found
I'd been auditing third-party listings ahead of the launch, and the audit turned up something I should have caught earlier. Of thirteen third-party API listings on the marketplace, only two were actually returning HTTP 402 challenges when called. The other eleven returned open 200 responses. They were APIs in the directory sense — listed, discoverable, displayed with "$0.01 per call" pricing — but no agent calling them was ever being asked to pay. They were free APIs with payment-looking labels next to them.
The marketing I'd been writing talked about agents paying micro-amounts in USDC to discover and use APIs. The marketplace I'd actually built was, for most third-party listings, a directory pointing at free endpoints. That gap is the kind of thing that ends careers in this space if it ships into a Coinbase-tagged launch post and a technical person clicks through to verify.
So I sent honest emails. To Ava, to Andy Mitchell, to anyone whose listing had been displayed as "verified" when it wasn't. The emails said the same thing in different words: your APIs are listed correctly, the data is real, but the payment layer isn't yet enforced at the endpoint level. Bazaar indexing and real settlement require the endpoint to actually return a 402 challenge. Here's what you'd need to add.
What happened next is the reason this post exists.
Ava Torres shipped real x402 in twelve hours
Ava added production x402-gated mirrors to AutoScrape in twelve hours. By Thursday evening, all five of her APIs — Business Registry, Building Permits, SEC EDGAR, IRS 990, and WHOIS — returned proper 402 challenges with CDP Facilitator routing on Base mainnet, settling in real USDC at $0.01 per call. The next morning she patched the metadata again to make the keyword descriptions explicit for Bazaar discovery. Her provider page is at payapi.market/provider/ava-torres. The Business Registry covers 17 US states in the no-key pilot (California is keyed/bulk-only). You can verify it works right now: a query for Apple Inc across NY and TX returns clean registry filings, and a Chicago roof-permit search returns deterministic permit records.
She volunteered this sentence when I told her there wasn't a launch post anymore:
PayAPI was the first place where AutoScrape's public-records APIs were verified through the full agent-payment loop, not just listed: x402 challenge, CDP Facilitator settlement, and Bazaar discovery. That matters because buyers can route KYB, merchant underwriting, permit-lead, SEC EDGAR, IRS 990, and WHOIS checks through a real payable endpoint instead of a demo.
After PayAPI Market funded two rounds of $0.05 settlements through her routes to trigger Bazaar indexing, AutoScrape now ranks #1 on CDP Bazaar for "SEC EDGAR" and "IRS 990", and top-five for several of the higher-intent KYB and underwriting searches.
Andy Mitchell exposed a real gap in my listing model
Andy Mitchell taught me something else. Andy runs four UK data APIs at energybilltoolkit.co.uk — M2M Trust for Lean Six Sigma audits, UK Air Quality, Text Metrics, and UK Waste Collection. When I sent him the honest email saying his endpoints weren't returning 402, he replied politely but firmly: yes they are, and you tested the wrong layer. He was right. His listing's "base URL" pointed at the directory page, but his actual paid endpoints sit one path level deeper at /tools/*, and those return clean 402 challenges with valid x402 v2 payloads on Base. The audit tooling I'd built only checked the listed base URL. Andy's pushback exposed a real gap in PayAPI Market's listing model — it tracks one URL per listing when the real pattern often has an unprotected catalogue at the root and the paid endpoints under sub-paths. That's now logged as a proper schema fix.
Andy described himself in his next email as a hobbyist learning by doing rather than a company. That's the rarer profile, not the lesser one. He shipped working x402 middleware faster than most commercial providers do.
Katsushi made x402 click
Katsushi runs bittensorman.xyz and put OSS2API on PayAPI Market the same week. OSS2API is a multi-skill API: background removal, URL analysis, browser extraction and screenshots via Playwright, and a security scanner for HTTP headers and HTML risks. All four skills sit behind one x402-payable gateway. He also runs URL2AI, which composes OSS2API and LLM2API endpoints into higher-level agent workflows.
What made x402 click for me was that it removes the API-key ceremony entirely. OSS2API wraps four different OSS tools — background removal, URL analysis, browser automation, security scanning — under one endpoint. An AI agent can call whichever skill it needs and pay per use, without any pre-registration or quota negotiation. That's the part that feels genuinely new: the billing surface matches how agents actually work.
Katsushi also runs a JPYC variant of OSS2API on Polygon, settled via EIP-3009 — same endpoints, around ¥1 per call, for Japanese-yen agent payments. PayAPI Market is Base-first because the x402 protocol's gravity is there. The x402 protocol moved to the Linux Foundation this April, and the Coinbase team launched Agentic.Market the same month, both signals that the category has gone from "interesting bet" to "where things are heading" in about six weeks. But the protocol itself is chain-agnostic and providers are already proving it. Multichain is happening quietly, in production, in JPY-denominated calls landing on Polygon while USDC settles on Base.
What's hard is the honesty work
The agent economy isn't theoretical. It's small, but it settles real USDC, real JPYC, on real chains, every single day, into real wallets. What's hard isn't the protocol. What's hard is the honesty work of distinguishing genuine settlement from theatre. A lot of the infrastructure that gets called "agent payments" is one or two layers short of actually charging anything. The marketplaces are real; the payment loops, often, are not.
PayAPI Market now displays two states on every listing: "x402 verified" for endpoints that genuinely return a 402 challenge and settle on-chain, and "Listed" for endpoints in the directory that haven't yet enabled payment enforcement. Twenty-two listings currently show verified across four providers. Two show listed. That ratio will move as providers add payment layers, but the badge will stay honest either way.
If you've got data agents would pay to query, the listing flow takes ten minutes at payapi.market.