Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Web Security TippsIntroducing the new Confluence integration with Google Chat(22.09.2026 um 19:40 Uhr)
Web Security TippsQuick notes in Take notes for me(22.09.2026 um 21:31 Uhr)
Sichere ProgrammierungSecurity improvements for SSH(22.09.2026 um 16:11 Uhr)
Sichere ProgrammierungKI-Akzeptanz: Wie Rewe digital einfach nur den Chatbot umbenannte(22.09.2026 um 18:00 Uhr)
Sichere ProgrammierungClaude Opus 5.5: Keeping safety ahead of capabilities(22.09.2026 um 20:59 Uhr)
Sichere ProgrammierungYour Terraform Monolith Isn't Too Big. It's Tightly Coupled.(22.09.2026 um 21:00 Uhr)
Sichere ProgrammierungMy PR got merged into Mike — OSS Legal AI Platform 🎉(22.09.2026 um 21:34 Uhr)
Sichere ProgrammierungStop Writing JavaScript To Fix `100vh` On Mobile(22.09.2026 um 21:35 Uhr)
Sichere ProgrammierungNext.js proxy.ts Explained (with Cheat Sheet)(22.09.2026 um 21:36 Uhr)
Web Security TippsIntroducing the new Confluence integration with Google Chat(22.09.2026 um 19:40 Uhr)
Web Security TippsQuick notes in Take notes for me(22.09.2026 um 21:31 Uhr)
Sichere ProgrammierungSecurity improvements for SSH(22.09.2026 um 16:11 Uhr)
Sichere ProgrammierungKI-Akzeptanz: Wie Rewe digital einfach nur den Chatbot umbenannte(22.09.2026 um 18:00 Uhr)
Sichere ProgrammierungClaude Opus 5.5: Keeping safety ahead of capabilities(22.09.2026 um 20:59 Uhr)
Sichere ProgrammierungYour Terraform Monolith Isn't Too Big. It's Tightly Coupled.(22.09.2026 um 21:00 Uhr)
Sichere ProgrammierungMy PR got merged into Mike — OSS Legal AI Platform 🎉(22.09.2026 um 21:34 Uhr)
Sichere ProgrammierungStop Writing JavaScript To Fix `100vh` On Mobile(22.09.2026 um 21:35 Uhr)
Sichere ProgrammierungNext.js proxy.ts Explained (with Cheat Sheet)(22.09.2026 um 21:36 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

How I Built a 120-Endpoint x402 API Marketplace in a Weekend (And Why It Matters)

How I Built a 120-Endpoint x402 API Marketplace in a Weekend (And Why It Matters) Building the "Swiss Army Knife" for AI Agents on the x402 protocol The Problem I've been building on the x402 protocol — Coinbase's m…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




How I Built a 120-Endpoint x402 API Marketplace in a Weekend (And Why It Matters)




Building the "Swiss Army Knife" for AI Agents on the x402 protocol










The Problem



I've been building on the x402 protocol — Coinbase's micropayment standard for AI agents. The idea is beautiful: agents call APIs, pay per request with USDC, no API keys, no subscriptions. It's the HTTP of agent commerce.



But there was a gap. When I looked at the existing services, they were all single-purpose:




  • BlockRun: AI chat completions

  • OttoAI: AI chat completions

  • Aubr: AI search



One API = one task. An agent that needs a price chart, a weather report, a blockchain lookup, and an AI chat — that's four different x402 integrations.



That's when I realized: nobody had built the "everything API" for agents.









The Idea



What if one API could do everything an agent needs?





  • Blockchain: 🪙 BTC price, gas fees, wallet balances, ENS lookup, DeFi insights


  • AI: 🤖 Chat, code, translation, image generation, video generation


  • Weather: 🌤️ Current, forecast, historical


  • Social: 🐦 Twitter, Discord, Telegram, Instagram, TikTok


  • Search: 🔍 Web search, arXiv, GitHub


  • E-commerce: 🛒 Product search, reviews


  • Finance: 💱 Forex, stocks, commodities


  • Utilities: ✉️ Email verification, IP lookup, domain WHOIS, URL shorten


  • Security: 🔐 AML screening, KYC verification, phishing detection


  • PI: 🏢 RWA, real estate, credit scoring, bond data



120 endpoints. 20+ categories. One API.



That's GoldBean.









The Tech Stack



The stack is refreshingly simple:




GoldBean = Express.js + x402 micropayments + ChatGPT









Architecture






┌─────────────┐     ┌─────────┐     ┌──────────────┐
│ AI Agent │────▶│ nginx │────▶│ GoldBean │
│ (x402 SDK) │ │ (SSL) │ │ (Express.js) │
└─────────────┘ └─────────┘ └──────────────┘

┌──────┴──────┐
│ Base Chain │
│ (USDC on │
│ eip155:8453)│
└─────────────┘






The flow is elegant:




  1. Agent discovers GoldBean via /.well-known/x402 or /openapi.json

  2. Agent calls /paid/llm-chat → gets back HTTP 402 Payment Required

  3. 402 response includes Payment-Required header (base64-encoded JSON: amount, network, payTo)

  4. Agent pays via x402 → gets back a payment receipt → retries with it

  5. GoldBean validates → serves the response



No API keys. No auth. No subscriptions. Just pay and use.









The Hardest Part: Getting Registered on x402scan



This deserves its own section because it took longer than building the API.






What x402scan expects



The x402scan scanner validates four things:





  1. /.well-known/x402 — discovery endpoint


  2. /openapi.json — the canonical API contract


  3. /openapi.json has x-payment-info on paid endpoints


  4. Endpoint returns proper HTTP 402 with Payment-Required header






The 402 Header Format (V2)



Here's the format that works (took 6+ iterations to nail):




{
"x402Version": 2,
"accepts": [{
"scheme": "exact",
"network": "eip155:8453",
"amount": "40000",
"asset": "0x833589f...",
"payTo": "0x7484b0...",
"maxTimeoutSeconds": 300
}],
"resource": {
"url": "https://goldbean-api.xyz/paid/llm-chat",
"description": "llm-chat",
"mimeType": "application/json"
}
}






Lessons learned:





  • x402Version must be a number (not string)


  • amount is in atomic units (USDC = 6 decimals, so $0.04 = "40000")


  • amount must be a string (not number)

  • Body must be empty {} (V2 moves all payment info to headers)

  • The response must have Cache-Control: no-store

  • Add BOTH Payment-Required AND x-payment-required headers for compatibility



I built an x402-check tool to verify format — it saved me hours of debugging.






The Schema Trap



Getting 31/120 endpoints registered was easy. The remaining 89 all failed with:




Missing input schema




The fix: every endpoint needs a proper input schema in OpenAPI so the scanner can construct a valid test request. A parameter like address for address lookups, prompt for chat endpoints, lat/lon for weather. The scanner reads the OpenAPI, builds a probe request, and expects 402. Without input schemas, it can't even probe.









What Running 120 Endpoints Actually Looks Like






The Good



One server process. One domain. One integration. 120 capabilities.




npx agentcash try https://goldbean-api.xyz






Boom. Your agent can now check BTC price, get a weather forecast, generate an image, analyze sentiment, and chat with an LLM — all through a single API with a single $USDC wallet.






The Reality Check



$0 revenue. 0 buyers. 0 transactions.



Registration doesn't equal usage. The next phase is getting actual agents to call the endpoints. That means:





  1. Dev.to / Medium — telling the story


  2. Community — showing up on x402 Discord/Twitter


  3. Free trials — first 10 calls free to lower the barrier


  4. Self-hosting — running automated calls to generate initial tx records (who wants to be the first buyer of a zero-tx service?)









What's Next











































Phase What When
🚀 All 120 endpoints on x402scan This week
📝 dev.to/Medium article series This week
🐦 Twitter/X presence (@x402 ecosystem) This week
🆓 Free trial mechanism Next week
📊 Operations dashboard Next week
🔌 Marketplace platform (3rd-party endpoints) June








Why I'm Building This



The x402 protocol is going to be huge. 480,000+ agents already transacting, $165M+ in agent-to-agent commerce on Base chain.



But the infrastructure is still early. Most x402 services are single-purpose. GoldBean is my bet that agents need a general-purpose API — one they can call for anything, without worrying about "does this endpoint support x402?"



120 endpoints down. 200+ on the roadmap.



Let's see where this goes.






Built with ☕ and x402. Check us out: https://goldbean-api.xyz

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten How I Built a 120-Endpoint x402 API Marketplace in a Weekend (And Why It Matters)

Thematisch verwandte Begriffe: Built, 120Endpoint, x402, Marketplace · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-77259 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian pro…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick