# 2 of 5 MPP-only endpoints are still unpayable by a standard x402 client (checked 2026-10-30)

In September I emailed five endpoints that answer 402 but cannot be paid by an x402 client,
because they emit an MPP challenge and no `Payment-Required` header. All five replied. I re-checked
the same five today to see which ones actually shipped the fix.

## Result

| Endpoint | HTTP | `Payment-Required` | `www-authenticate` | Verdict |
|---|---|---|---|---|
| api.search1api.com/screenshot | 402 | absent | present (method=tempo) | still MPP-only |
| mpp.celenium.io | 402 | absent | present | still MPP-only |
| api.reletter.com | 200 | absent | absent | no challenge at all on this path |
| api.weftly.ai | 200 | absent | absent | no challenge at all on this path |
| mpp.clashofcoins.com | 200 | absent | absent | no challenge at all on this path |

Two of the five still answer 402 with an MPP challenge and nothing an x402 client can read.
Three no longer answer 402 on the path I probed, which may mean the endpoint moved rather than
that it was fixed; those need the vendor's own path before the check is meaningful.

## The exact gap, for the two that still fail

```
GET https://api.search1api.com/screenshot  ->  402
www-authenticate: Payment id="UEU4OzanPaJlrwmAveJ7gx88MxkOtsckLNjfv4Us0T8",
                  realm="api.search1api.com", method="tempo", intent="charge", request="eyJhbW91bnQi..."
payment-required: (absent)
```

A standard x402 client reads the payment requirements from the base64 JSON `Payment-Required`
header. It does not parse `www-authenticate`, and it does not read a body on a 402. With that header
absent the client cannot construct a payment, so the endpoint is unreachable for every x402-native
buyer even though it returns the right status code. The MPP rail is valid on its own; the two headers
are not interchangeable.

## Machine-checkable results

```json
{"url":"https://api.search1api.com/screenshot","checks":{"C0_http_402":true,"C1_payment_required_header":false,"C6_discovery_listing":false},"score":"1/3","verdict":"PARTIAL/FAIL","report_sha256":"5485fa131b5c716b6a09c1708665bad116dbbdb71cf0ab8097d120fbf4e035fd"}
{"url":"https://mpp.celenium.io/","checks":{"C0_http_402":true,"C1_payment_required_header":false,"C6_discovery_listing":false},"score":"1/3","verdict":"PARTIAL/FAIL","report_sha256":"185b938c3588afa76bb74777ae68e5e2ab17c3d013a1a178c87d4b22b0982c67"}
```

Same input, same hash. Re-run the two GETs above and you get these results back.

## The fix, in one line per endpoint

Emit the same challenge you already build as a base64 JSON `Payment-Required` header next to
`www-authenticate`. Dual-stack, not a replacement: MPP clients keep reading the header they already use.

## Why I publish this

These checks are three requests and need no account. I run them because a seller that cannot be paid
loses every x402 buyer silently, and the seller usually finds out from a drop in traffic rather than an
error. If you run an x402 endpoint and want the same three checks on it, the request is free and I will
send you the raw headers back.