An independent directory, x402-list.com, lists twenty-five API services that accept per-call payment in USDC. We cross-referenced all of them against every registrable domain APIs.io knows — 28,038 of them, drawn from provider URLs, API base URLs and APIs.json pointers. One was in our catalog. The other twenty-four are live, payment-ready, and we had never heard of them.
We did not take the directory’s word for it. Ten of the twenty-five were probed directly: an unauthenticated request to a documented paid endpoint, checking for a 402 and protocol evidence — an x402 response header, or a body carrying accepts[] with a scheme, an asset and a payee. Ten of ten answered with a real challenge. Most carried a complete payment requirement naming the network, the token contract and the address to pay.
So the x402 economy is not theoretical, and it is forming almost entirely outside the catalogs that are supposed to index it. That is a finding about discovery infrastructure, ours included.
The measurement failed the first time, in an instructive way
The first pass probed each service’s base URL and found zero adopters. Then ten of those same services were confirmed by hand to be serving genuine challenges.
An x402 challenge lives on the paid resource, not at the root. A base URL is usually a landing page or a health check answering 200. A sweep of base URLs returns a confident zero and measures nothing — the same shape of error as reading a status code instead of a body, one layer up.
The probe now reads documented operation paths out of each provider’s own OpenAPI. That is also the reason this had not been measured before: a discovery pipeline fetches well-known documents, and a payment challenge is not a document and has no well-known path. The address of the evidence was sitting in contracts we already held.
Inside our own catalog, seven of thirty-two
Thirty-two providers carry the x402 tag. Seven serve a verified challenge. Every one of those seven passed a negative control — a request to a path that cannot exist, which must not be challenged, or the host is running middleware that paywalls everything and its “adoption” is a default.
Seven is a floor, not a count. The twenty-four that did not answer returned 530s, connection failures, 200s and 401s at the paths we chose, and a 401 is authentication, not payment.
Why we are not scoring it
The Kin Score does not measure x402 and will not yet. Seven providers out of more than 27,000 is not a distribution, and a dimension cut against it would measure the market rather than the provider. The rule the rubric already applies to draft protocols applies here: a dimension nobody can earn measures the market, not the participant.
What changes is that it is now measurable. When the population is in the hundreds, there will be something to score — and the probe that would score it already exists.
Twenty-three of the twenty-four are queued for the catalog; the last one was already there under a different name, which is its own small lesson about matching companies by domain.