Your x402 endpoint can be listed, indexed and priced correctly, and still be impossible to pay from half the agent stack. On 2026-10-14 I sent unpaid requests to every origin in the Coinbase CDP Bazaar and measured one thing most sellers never look at: the size of the PAYMENT-REQUIRED header.

The short version

  • 2,332 origins in the Bazaar (34,705 resources). 2,127 answered a probe with HTTP 402.
  • 156 of those 402s carry a PAYMENT-REQUIRED header longer than 8,190 bytes. Python's aiohttp rejects any header line that long by default, so an aiohttp-based agent gets ClientResponseError: 400, message='Got more than 8190 bytes when reading' and never sees your price.
  • 4 send more than 16 KB of headers. Node's built-in fetch (undici), and therefore @x402/fetch, fails with UND_ERR_HEADERS_OVERFLOW. The largest was 55 KB.
  • 55 more sit between 12 KB and 16 KB, one bigger example away from the Node limit.
  • requests and httpx (the official Python SDK's client) read 32 KB headers without complaint, which is why sellers testing with curl or Python never notice.

Per-origin data and the method are public: x402doctor-data/HEADER-SIZES.md.

Why the header gets so big

In x402 v2 the whole PaymentRequired object travels base64-encoded in one header. That includes the Bazaar discovery extension: your input example, your output example, and the JSON schema. Sellers reasonably paste a full, realistic response as the output example. On the 55 KB endpoint, the output example alone was 29 KB (a complete vulnerability report) and the schema another 12 KB, while accepts was 1.2 KB.

The other common cause is accepts itself. One operator offers 14 payment options per route (several networks and stablecoins); that alone is about 4 KB of JSON before base64.

Base64 adds a third on top of the JSON, so a 6 KB challenge is already an 8 KB header.

Check yours 

curl -s -D - -o /dev/null https://your-api.example.com/paid-route | grep -i '^payment-required' | wc -c

Over 8,190: aiohttp users can't read it. Over about 16,000 (all headers together): Node users can't either.

Or run the free origin audit I built, which reads your OpenAPI like the indexers do, probes each paid route with your own examples, reports header size, and lists which routes the CDP Bazaar has actually indexed for your payTo: pitcrew-api.appin60.com/app#audit.

Fixing it

  1. Make the output example one representative item, not a full response. The schema already documents the shape.
  2. Trim schema description strings in the discovery extension; keep the long prose in your OpenAPI.
  3. Only list accepts entries you actually settle. Every extra network/asset pair costs about 300 bytes.
  4. Aim for under 8 KB. That keeps every common client happy.

I also opened an issue proposing a size budget and a middleware warning upstream: x402-foundation/x402#3803.

Method and caveats

Unpaid GET/POST probes only, up to two resources per origin, using the Bazaar's stored example input (query, path and body). Header bytes are measured on the raw response. Results are a snapshot: sellers change their metadata often, and an origin I could not reach (DNS failure or timeout) is not counted either way. aiohttp and Node limits are defaults; clients can raise them, but most agents don't.

Disclosure: I build Pitcrew, a pay-per-call toolkit for agents and x402 sellers. The audit above is free in the browser and $0.02 per call over x402.