Developer preview · free · runs on your device
Inspect proof and payment requests
Your agent needs to prove something, pay for something—or both. Inspector helps you spot header, browser-access and caching mistakes before you chase the wrong problem.
See a fix in one minute.
A synthetic response contains a proof request, but browser code cannot read the header. Run the broken example, then the fixed one. The fix exposes PROOF-REQUEST and adds no-store; the comparison shows exactly which check outcomes change.
Both captures are synthetic. The fixed example has no failures in the checks performed; one scope-boundary check remains inconclusive. Credentials and paid delivery remain untested.
01 / Check a capture
Start with an example.
You do not need to understand the protocol to see what breaks. All examples are synthetic.
Use your own capture
Supply one request, response or preflight as JSON. Preserve headers as pairs so duplicates remain visible. Use a sanitised test capture; keep real credentials out of shared reports. Inputs stay in this page’s memory and are cleared on reload.
02 / Understand the result
Ready when you are.
Load an example and inspect it. Findings explain the particular check; there is no overall safety or certification score.
03 / Check your fix
What changed?
Save the current capture as a temporary baseline, then inspect another. The comparison shows changed check outcomes and whether selected x402 payment terms changed, even when both captures pass structural checks; it never prints input values.
No baseline selected.
Try the broken example, then the fixed example.
What it checks
x401 draft 0.2.0 wire objects using the official SDK; header direction and duplicates; selected CORS and cache settings; basic x402-v2 offer structure. Each finding links to its source and states whether it is a requirement or advice.
What it cannot prove
A captured header cannot prove an identity, check issuer trust or revocation, enforce replay protection, reveal whether protected content leaked, or establish payment and delivery. Unknown context stays unknown. This tool does not complete a proof exchange.
Use it in your development workflow.
Download the self-contained offline CLI kit (SHA-256). It runs on Node 22+ without installing packages or making network calls. A reported failure exits with code 1; invalid input uses 2. Warnings and untested checks remain visible.
Need a complete exchange? Start with the existing x401+x402 sandbox. For credential-layer testing, use the OpenID test suite. Inspector complements these tools.
Price: free. No paid plan or certification is offered. If a check saves you time, tell us which problem it helped solve—please do not email live credentials or private captures.
Next: compare payment terms with your own policy and recorded observations →