Is x402 safe? How to spot scams trading on its name

x402 is a real, legitimate, widely backed protocol. It's also exactly the kind of fast-growing, technical-sounding crypto term that attracts impersonators — fake tokens, fake "presales," and fake "official" sites trying to borrow its credibility. This page exists to draw a clear line between the two.

What the real protocol is

x402 is an open technical standard for HTTP-based payments, originally published by Coinbase and now governed by the x402 Foundation, hosted under the Linux Foundation, with a wide membership spanning major payments and infrastructure companies. It defines how a server requests payment and how a client pays it — nothing more. It doesn't have its own currency, doesn't run a public sale, and doesn't have an "investment" component at all. It's infrastructure, the same way a shipping standard or a file format is infrastructure — not an asset you buy and hold expecting it to appreciate.

Common scam patterns to watch for

• "x402 token" listings on exchanges or token launch sites. If something is being sold as a coin or token under the x402 name, it has no connection to the actual protocol. The protocol doesn't issue one.
• Urgency-driven "presale" or "early access" pitches. Legitimate infrastructure protocols don't need you to buy in before a deadline. This pattern is a near-universal signal of a scam regardless of which legitimate technology name it's attached to.
• Sites or social accounts claiming to be the "official x402 wallet" or "official x402 exchange." The protocol doesn't have an official consumer wallet or exchange — it's a specification that wallet and infrastructure providers implement, not a single branded product.
• Requests to send funds to "activate" or "unlock" x402 payments. A real x402 payment only ever involves paying the exact, transparent amount shown in a 402 response for the specific resource you're requesting — never a setup fee, activation fee, or unlock fee paid separately.

How to verify something is legitimate

Check whether the specific implementation — a facilitator, a wallet feature, an API's payment integration — is documented by a company you can independently verify, ideally with a public technical writeup or open-source code. The x402 Foundation's own site and major members' documentation (Coinbase, Cloudflare) are reasonable anchors for confirming whether something connects to the real ecosystem.

If you're evaluating whether to integrate x402 into your own API or business, the same logic applies: work from a provider's own current documentation rather than third-party explainer content (including this site) for anything involving real funds.

If you think you've encountered a scam

Don't send funds, don't connect a wallet, and don't share a seed phrase or private key with anything claiming to need it to "verify" or "unlock" an x402-related payment — a real payment never requires that. If you've already lost funds, report it through your wallet provider or exchange's fraud reporting process; recovery isn't guaranteed, since on-chain transactions are generally irreversible, but reporting helps platforms flag related scam infrastructure for others.

This page is general safety information, not financial or legal advice. If you're unsure whether a specific service is legitimate, verify directly with the x402 Foundation or the provider in question before sending any funds.