402 PaidEndpoint.Method & sources ↗

THE UNSIGNED CHALLENGE INSPECTOR

Read the 402.
Understand the ask.

Turn an opaque payment-required response into fields you can inspect. Decode the challenge, explain its errors, and see what changed.

402

PAYMENT REQUIRED
What is the server asking for?

Local by design. Inputs stay in this browser. No wallet, endpoint requests, uploads, telemetry, or saved history.

01 / INPUT

256 KiB max

Paste an unsigned challenge

Use JSON, standard padded base64, a PAYMENT-REQUIRED: line, or an HTTP 402 response. Never paste secrets or signed authorizations.

Ready for an unsigned server response. Examples use fictional resources.

Atomic units → human units

Use decimals verified for this exact asset and network. No conversion is inferred from the asset name or server metadata.

02 / INTERPRET

Unsigned only

Clarity starts here.

The decoded error, network, atomic amount, asset, recipient and timeout will appear here.

03 / COMPARE

Did the challenge change?

Compare challenge A with a second unsigned response. Check changes in the server’s error, amount, network, recipient, resource and other fields. No payment is constructed.

METHOD / REVIEWED 12 OCT 2026

A decoder, with a defined boundary.

What we check

Core v1/v2 response shape, required fields and types, v2 CAIP-2 network syntax, and decimal integer strings for atomic amounts. Comparisons retain exact number literals and match payment choices by position.

Human units use decimal string placement, never floating-point arithmetic. Supply verified decimals; server metadata is not a trusted asset registry.

What a result means

Passing core shape checks does not prove scheme compliance, cryptographic authenticity, asset/address validity, trust or safety. The server’s error text is a claim, not verified evidence. Unknown fields are retained; extension and scheme semantics are not evaluated.

v1 carries requirements in the 402 body. v2 uses the base64 PAYMENT-REQUIRED response header. A v2 body alone does not establish compliant HTTP signaling.

Primary sources

Issue discussion motivates decoding error fields; it does not establish market demand or a universal SDK bug. Source revision: f8f8330.