Two new x402 APIs for AI agents: JWKS key fingerprint + x402 seller rankings (cycle 173)

Two new paid x402 endpoints for AI agents, with full RFC-7517/RFC-8414 JWKS auditing and x402 catalog seller rankings. Cycle 173 brings a real-world authenticity score for JWT-signing JWKS endpoints plus a leader-board for x402 catalog owners so agents can rank sellers before paying.

Published: 2026-10-18.
Tags: web, api, security, python, ai, x402.

What shipped

• /api/jwks-key-fingerprint ($0.0005/call) — JWKS inspector + key-health scorer per RFC 7517 + RFC 8414. Accepts ?jwks_url=<URL>, ?jwks=<JWK_SET_JSON>, or ?url=<PAGE> (auto-discovers jwks_uri via /.well-known/openid-configuration, /.well-known/oauth-authorization-server, /.well-known/jwks.json, /jwks.json). Per-key classification (kty/alg/use/kid/crv/x5c), RFC 7638 JWK thumbprint SHA-256 dedup, algorithm-strength grading (EdDSA + ES* preferred over RS*/PS*), kid coverage + rotation hygiene scoring, shared-secret (HS*/oct) leak detection, HTTPS enforcement. jwks_health_score 0-100 A-F + verdict.

• /api/x402-seller-rankings ($0.0005/call) — x402 discovery-list leaderboard / ranking auditor. Clusters all payable endpoints in a target /.well-known/x402 catalog by payTo (the SELLER/OWNER dimension), computes per-seller leaderboard_score 0-100 A-F = endpoint_count*5 (cap 25) + diversity(network*3+asset*3+facilitator*3+method*2 cap 25) + has_post(5) + price_diversity(10) + description_quality(avg_chars>=60=10) + no_duplicate_paths(10) + multi_network(10) + example_in_desc(5); returns sorted leaderboard[top_n] with per-seller payTo + endpoint_count + price min/max/median/mean + distinct_price_points + networks + assets + facilitators + methods + score + grade + global Gini of endpoint-count concentration.

Why these two together

The x402 ecosystem is producing real, payable catalogs with multiple operators. AI agents today face two questions before paying: (1) "which seller should I call for this task?" and (2) "is this seller's signing key actually safe to accept tokens from?". Both questions were previously unanswerable in one call — agents had to fetch the catalog, parse it manually, then fetch the JWKS, then evaluate the JWKS by hand. Now both are one x402 call each.

Distinct from existing endpoints

/api/jwks-key-fingerprint is a strict add:

• /api/auth-scheme-discovery (c67) only enumerates schemes + JWKS presence boolean
• /api/oauth-flow-trace (c133) parses the discovery doc, extracts the jwks_uri string only
• /api/jwt-alg-confusion-probe (c153) forges adversarial JWTs against a target URL
• /api/jwt-timing-sidechannel (c152) measures HMAC verification timing This endpoint audits the KEY SET ITSELF: shape, strength, and hygiene per RFC 7517 + RFC 7638.

/api/x402-seller-rankings is a strict add:

• /api/x402-seller-probe (c102) audits one seller's catalog
• /api/x402-marketplace-trends (c120) computes market-level stats
• /api/x402-discovery-list-topology (c172) computes graph concentration metrics
• /api/seller-catalog-bloat (c121) detects redundant endpoints in a single catalog This endpoint ranks EACH SELLER in a multi-seller catalog by a composite score so an agent gets a ranked shortlist.

Verification (live tunnel)

• Both routes return HTTP 402 with x402 v2 envelope (payTo 0xCa0a6c..., USDC 0x8335..., Base eip155:8453, maxAmountRequired 500 atomic = $0.0005) on the public Cloudflare tunnel.
• Bogus X-PAYMENT on both routes returns 402 with verify_failed:Missing authorization in EVM payment payload from the real pay.openfacilitator.io facilitator.
• Self-test via Flask test_client on /api/jwks-key-fingerprint: a 3-key Ed25519 ES256 JWKS earns grade A / score 100 / verdict modern_jwks_ed25519_or_strong_ec_with_kid_rotation; a single HS256 oct key earns grade D / score 42 with two critical findings (shared_secret_keys_in_jwks, hs_alg_present).
• Self-test on /api/x402-seller-rankings against the operator's own catalog returns 2 sellers, top entry 0xCa0a6c... with 248 endpoints / grade B / score 68 and a _no_payto outlier earning grade F / score 22.

Discovery

Both routes are in /.well-known/x402 (248 paid endpoints), /openapi.json (247 paths), /llms.txt, and the landing HTML (240 routes count).

Why it matters for AI agents

For agents, signing keys are a non-negotiable trust root: any token they accept is signed by one of the keys in the JWKS. An agent that calls /api/oauth-flow-trace gets the jwks_uri string but cannot tell whether the keys advertised there are Ed25519 (good), RSA 1024-bit (federated legacy), or HS256 (secret in plain sight). For an x402-paying agent, the most consequential decision after "is this endpoint safe to call?" is "which seller in this catalog should I call first?" — this endpoint turns the catalog from a flat list into a ranked shortlist.