← Atlas ▌402atlas · onboarding report
The free onboarding report

x402, paid-tested: what's worth using.

6 whitelist services we bought with real USDC — each with the exact call and the real response. Plus how to make your first payment, what to avoid, the market in three honest layers, and exactly how we test.

updated 2026-07-27·// verify, don't trust·every claim has an on-chain receipt
01 — Make your first call

From zero to your first paid call

No account, no API key, no subscription. You need a wallet that can pay USDC on Base, and a client that speaks x402.

Wallet + USDC on Base

Coinbase Wallet or MetaMask on the Base network. Buy 5–10 USDC. Most services have a facilitator pay gas, so you can run on 0 ETH.

An x402 client

For a human at a terminal — the official CLI:

$ npx awal@latest

For an agent in code — the @x402/fetch library wraps fetch to pay automatically.

How a call works

request → 402 Payment Required → wallet pays USDC → retry → 200 + data. The client does pay-and-retry for you; it settles in seconds.

A real gotcha we hit (so you don't): the x402 spec moves fast — services now send the newer eip155:8453 network format, and older client libraries silently reject it and fail to pay. Use a current client (@x402/* v2.11+ or latest awal), not the old x402-fetch package. Keep your x402 wallet separate from your main funds — most services don't refund, so try a cheap endpoint first.
02 — What's worth using

The whitelist

6 services that clear our strictest bar — we paid, captured the response, and verified the content is real (signature checks, on-chain forensics, a live database we wrote to and read back), then a human signed off. Picked to show what x402 actually unlocks for your agent — things it genuinely cannot do alone, not "look up a number you could Google in a second." Every entry shows the exact endpoint and the real body it returned.

Actions your AI literally cannot take

StablePhone ★ Merit Systems · the one we use most$0.54 call · $0.05 lookup
Your AI places a real phone call — dials a US number, speaks your task in natural voice, hangs up.
Endpoint
POST stablephone.dev/api/call · body: { "phone_number": "+1…", "task": "…" }
No model can place a phone call. Building telephony means numbers, carriers, compliance — not a weekend. $0.54 and it just dials.
Async: returns a call handle, then the AI dials seconds later. US numbers only.
paid-test record — how we bought it + on-chain receipt
Tested2026-05 · Merit Systems BoughtPOST stablephone.dev/api/call · body {phone_number, task} · $0.54 Receipt0xd7c5…c5d6c ↗ · Base · USDC

Proof & identity your AI can't fabricate

globalapi · Compliance ★ the strongest in the set$0.01
Screen a wallet against live OFAC / UN / UK sanctions lists, with on-chain forensics.
Endpoint
GET globalapi.dev/compliance/counterparty/{address}
What came back · we screened the Lazarus Group wallet (North Korea, OFAC SDN)
{ "verdict":"BLOCK", "sanctions":{ "result":"MATCH", "matches":[{ "list":"OFAC SDN", "entity_name":"LAZARUS GROUP", "programs":["DPRK3"], "sdn_id":27307 }] }, "lists_updated":{ "ofac":"2026-06-11" } }
Your AI doesn't carry the live sanctions list or trace a wallet's history. We proved it both ways — it BLOCKs a real sanctioned hacker and PASSes a clean wallet (Vitalik) and a court-de-sanctioned one (Tornado). $0.01 a screen.
Service self-labels "informational only — not legal compliance advice."
paid-test record — how we bought it + on-chain receipt
Tested2026-06-14 · Lazarus → BLOCK/MATCH BoughtGET globalapi.dev/compliance/counterparty/0x098B…2f96 · $0.01 Receipt0x5cd2…dea7b ↗ · Base · USDC
Laso · KYC token$0.001
Pay and receive a Google-signed identity token (Firebase ID token) to authenticate downstream callable APIs.
Endpoint
GET laso.finance/auth
What came back · a real RS256 JWT (decoded)
{ "auth": { "id_token": "eyJhbG…" } } // iss: securetoken.google.com/kyc-ts · signed by Google's x509 key · bound to your wallet
Your AI can't mint a token that Google's trust chain will verify. We checked the signature against Google's public keys — it's genuine. $0.001.
We verified the token itself; the downstream callable APIs it unlocks weren't tested.
paid-test record — how we bought it + on-chain receipt
Tested2026-06-11 BoughtGET laso.finance/auth · $0.001 Receipt0x0728…61ea5 ↗ · Base · USDC

Signed truth your AI can verify on-chain

Mycelia Signal · BTC/USD oracle$0.01
A cryptographically signed price — not a number to read, an attestation you can verify on-chain.
Endpoint
GET api.myceliasignal.com/oracle/price/btc/usd
What came back · signed, median of 10 exchanges
{ "canonical":"v1|PRICE|BTCUSD|63317.94|USD|2|binance,coinbase,kraken,…|median|…", "pubkey":"f4f0e52b…", "signature":"970e056…" }
Reading a BTC price is free. Getting one you can prove on-chain — Ed25519-signed, verifiable by anyone — is the part your AI can't fake. We verified the signature ourselves. $0.01.
Self-rooted trust (Mycelia's own key) — not anchored to an external trust chain like Laso's.
paid-test record — how we bought it + on-chain receipt
Tested2026-06-11 · signature verified BoughtGET api.myceliasignal.com/oracle/price/btc/usd · $0.01 Receipt0x05a3…b70e7 ↗ · Base · USDC
Mycelia Signal · EUR/USD oracle$0.01
Same signed-oracle, FX pair — median across central-bank & market sources.
Endpoint
GET api.myceliasignal.com/oracle/price/eur/usd
What came back · signed, sources include ECB
{ "canonical":"v1|PRICE|EURUSD|1.15|USD|2|ecb,bankofcanada,cnb,norgesbank,…|median|…", "signature":"…" }
Same Ed25519 attestation, FX — sourced from the ECB and other central banks. $0.01.
Canonical keeps 2 decimals — fine for proof, coarse for high-precision FX.
paid-test record — how we bought it + on-chain receipt
Tested2026-06-11 BoughtGET api.myceliasignal.com/oracle/price/eur/usd · $0.01 Receipt0x15ee…bb379 ↗ · Base · USDC

Infrastructure your AI can't spin up

Stablebase · on-demand Postgres$1 create · $0.02 query · $0.05 delete
Pay and a real PostgreSQL database is provisioned for you — connection string returned, wallet-scoped.
Endpoint
POST stablebase.dev/api/stablebase/projects/create
What we verified · the full lifecycle, on-chain
create → project ref + a live PostgreSQL 17.6 connection string. We connected directly: CREATE TABLE / INSERT a unique value / SELECT it back — then read the same value through the paid query endpoint. delete → gone in 20s.
Your AI can't conjure a real database from nothing. We ran the whole lifecycle on-chain — create, write, read-back through two channels, delete. $1 to stand one up.
Upstream is Supabase (host db.<ref>.supabase.co) — if Supabase changes terms, this is exposed. Provisioning takes ~10 min before queries work.
paid-test record — how we bought it + on-chain receipt
Tested2026-06-11 · create + query + delete all on-chain BoughtPOST stablebase.dev/api/stablebase/projects/* · $1 + $0.02 + $0.05 Receipt0x376c…76900 ↗ · Base · USDC
What we don't promise: that a service stays online (dormancy is common), that an upstream it depends on won't change (Stablebase rides on Supabase; Mycelia's signature is self-rooted), or that pricing holds. Endpoints and responses are from real paid tests in May–June 2026 — "worked when we checked," not a standing guarantee.
03 — What to avoid

What we paid for so you don't have to

We only flag a service here with on-chain, reproducible evidence — usually a payment we actually made.

lowpaymentfee.com — confirmed content fraud

Charges for a paid API and returns fabricated / worthless content — the clearest "this is exactly what Atlas exists to catch" case, with a full forensic write-up behind it. (Re-checked 2026-06-22: the site is now down, HTTP 525.)

On-chain: paid from audit wallet 0x3A0A…773E ↗ · 2026-05 batch (per-call hash not separately archived)
patentpulse — paid, then fabricated a patent report

We paid $0.08 to search patents. The response carried parse_error:true — its own parser failed — yet it still "synthesized" a confident patent-intelligence narrative for a query that matched nothing. That's fabrication, not search.

{"parse_error":true,"raw":"{ \"query_summary\": \"Keyword search for 'quantum computing' patents — one of the most active … domains in global IP …\" … }"}
Receipt 0xcc39…ac24 ↗ · Base · USDC · paid $0.08
filingspulse — same trick, SEC EDGAR version

$0.08 for SEC EDGAR full-text search. Same parse_error:true, then a fabricated result_count:8 plus an "AI synthesis" describing filings it never actually retrieved.

{"parse_error":true,"raw":"{ \"result_count\": 8, \"synthesis\": \"The EDGAR full-text search returned 8 filings matching 'Apple supply chain' … \" }"}
Receipt 0x3b2a…bff7 ↗ · Base · USDC · paid $0.08
btcnode.uk — paid settle, broken backend

Not fabrication — just broken. The $0.005 payment settled on-chain fine, but the API returned its own backend error: it couldn't reach its bitcoind node. You pay, you get an error string.

{"error":"… Could not connect to the server 127.0.0.1:18332 … Make sure the bitcoind server is running …","success":false}
Receipt 0x43e0…6809 ↗ · Base · USDC · paid $0.005
Capminal — paid, no research, just an empty reply

Billed as an "AI-powered Token Deep Research API." We paid $0.01 with valid token parameters; it took the money and returned an empty message — no research, no data. (An earlier test echoed our own input back instead — the failure is consistent.)

{"success":true,"message":""}
Receipt 0xbb21…a321 ↗ · Base · USDC · paid $0.01 · re-verified 2026-06-22
Pattern to distrust: "high volume = trustworthy"

In a market where most volume is wash, a high transaction count is not a quality signal — often the opposite. Don't pick services off a volume leaderboard. A pattern warning, not an accusation against any named service.

04 — Where you've landed

The market, measured — not guessed

We don't ask you to take "the market is mostly fake" on faith. Below: the picture in three layers, then every headline number with its source — external independent data where it exists, and our own re-runnable on-chain / paid-test scripts wherever we say something the catalogs don't.

On-chain data in this overview through 2026-05 (ecosystem figures 2026-05-29); the market has kept shrinking since — see the weekly-benchmark update (2026-07-27) in the market report. All scripts live in our repo and reproduce every cell.

Want the deep version? This is the onboarding-level overview (seller-side, through 2026-05). For the full forensic report (analysis 2026-06-14 · market update 2026-07-27) — the 8–15× tracker gap and the 6 top-10 buyers that traced to one self-funded loop (still dormant, re-checked 07-07), each with a clickable receipt — read the standalone market report →.

The three layers

1 · The whole x402 ecosystem background

Coinbase-led HTTP-402 + USDC standard, now in the Linux Foundation. Reported volume is large but mostly not real demand, and it has been shrinking hard from its late-2025 peak.

≥40% closed-loop wash — floor we prove (our scripts); ~81% by volume per Artemis (caveated)
$5.15M → $1.19M monthly gross, Nov-25 → May-26
~$1.6M real / 30d (Artemis, wash-stripped)

2 · The agent marketplace (Bazaar) deep-dived

The largest agent-service catalog, and the one we audited end-to-end. The feed is genuinely on-chain — but activity is heavily concentrated, mostly closed-loop, and the "#1 seller" isn't even a seller.

~750K tx / $263K rolling gross
top-10 = 78.8% of volume · top-1 = 39%
single-digit%–19% is real organic

3 · Everything else partly unknown

The marketplace we deep-dived is only ~34% of the ecosystem. PayAI (Solana-first) is actually larger, ERC-8004 is sizable, and the Solana side is mostly unmeasured. We spot-checked these and the quality pattern looks the same — but we mark it a known blind spot rather than claim we measured it.

~43% PayAI
~34% Bazaar (Base)
~20% ERC-8004

How we measured it — every number, traceable

Each claim below maps to either an independent external source or a script of ours you could re-run.

Why ranking by volume will mislead you

This is the one place we go against the grain — so here's the proof, not an opinion. The usual catalogs rank services by on-chain volume. In this market that surfaces exactly the wrong things, and we can show it three ways:

That's why Atlas doesn't rank by volume. We pay to call a service and report what came back. Volume is only ever used as a per-service anomaly flag — never as a recommendation.

And one number we threw out: we once estimated wash with a buyer-concentration "ratio" and got ~98%. On scrutiny the ratio conflated heavy real usage with self-dealing, so we dropped it and rebuilt on closed-loop + paid-test evidence — which is why our defensible figure is the ~40% floor, not the flashier 98%. Sources here disagree by up to ~18× and the market moves weekly; we report ranges with method + cutoff attached, never a single precise figure we can't defend. (More on corrections in how we test.)
05 — How we test

How we test — and why you can check us

Every claim in this report is something we did with real money and left a trace of. Here's the method.

We publish our own mistakes

  • We once used a buyer-concentration "ratio" to judge wash trading. It conflated heavy real usage with self-dealing — so we dropped it for closed-loop and paid-test evidence.
  • We first flagged SignalFuse as fake traction. On a closer check its buyers were genuinely independent — a real service. We corrected the call; it's verified in the paid catalog.
  • We listed services with "copy this command" before re-testing. When we actually re-ran them, an outdated client couldn't pay the new network format, and one "research" API turned out to just echo input. We fixed the client, dropped the dead ones, and kept only what paid through and returned real data.

Keeping the corrections visible is the point. An auditor that hides its errors is just another black box.

Want more than these 6? The full paid-test dataset — 166 paid-tested services (153 verified + 13 flagged avoid), each with its verdict, payTo, on-chain tx + amount, the captured response, and the exact request that produced it (495+ paid tests went into it, every one on-chain) — is the paid /verified API, callable by your agent over x402, pure x402 with no API key. live now.
Not sure it covers the service you need? Browse the free catalog → — search all 153 verified services by name or category before you spend a cent.