Half of x402 services have no front page an AI crawler can read

On 25 September 2026 we read the whole x402 Bazaar listing and opened the front page of every host in it, the way an AI crawler arrives: a single request, no browser, no JavaScript. Of 2,060 hosts, 949 (46%) answered with a page that says what the service is. The others handed the crawler JSON, an error code or a redirect.

An agent that already holds your endpoint never needs a home page. Everyone who has not found you yet starts at the root: a language model choosing which API to suggest, a search engine building its index, a developer who pastes the hostname into an address bar. For over half of these services, that first visit ends without one sentence of explanation.

What we measured

• The listing. The Bazaar is the discovery list that Coinbase Developer Platform keeps for x402: services register their paid endpoints there so that agents can find them. On the morning of 25 September it held 17,442 resources. We read every page of it and reduced them to 2,060 distinct hosts, in lower case and without www..
• One visit per host. First robots.txt, and we obeyed it; then one GET / under our own bot name, with a six-second timeout and no redirects followed. Never more than two requests to the same host.
• What counts as a page. HTML with at least 300 characters of visible text, or HTML with a title of its own plus a meta description or JSON-LD, and nothing our checker refuses outright (link farms, empty shells, banned topics). The probe ran the checker’s real code, not a copy of it.
• Controls first. Before the run, 14 known cases went through the same path: made-up hosts with planted answers and a few real sites. Every one of them landed where it should.

The results

JSON and 404 together account for 42% of the directory. In both cases the root of the host is an API rather than a page, and nothing on it tells a reader what the API is for. Among the readable pages, 740 had a meta description and 209 did not, which leaves a search result to invent its own summary.

Where a service is hosted changes the odds

Services on *.vercel.app nearly always had a page, because most of them are web apps that added a paid API. Hosts on *.workers.dev and on subdomains named for the API were mostly bare. On their own domains the services split close to evenly between a page and no page.

Front pages that ask for money

On 7 hosts the front page itself answered 402 Payment Required. To an agent with a wallet that is a valid offer. To a crawler, a search engine or a person it is a bill with nothing on it: no name, no description, no hint of what the payment would buy. The payment belongs on the endpoints; the root is where you explain them.

How to give an API a front door

1. Serve HTML at the root. A short static page is enough: what the service does, what one call costs, the endpoint path and a link to the documentation. It needs no framework and no JavaScript.
2. Point a bare API host at its explanation. If the service runs on api.example.com and the description lives on example.com, answer / with a 301 to that page instead of an error or JSON. Crawlers follow redirects; they do not guess the parent domain.
3. Keep the payment off the root. Ask for 402 on the paid paths. The root and robots.txt should stay free to read.
4. Do not shut the whole host. Disallow: / for every user agent keeps search engines out along with everyone else. Disallow the paid paths if you have to, not the entire site.
5. Write your own summary. A <title> and a meta description of a sentence or two decide what a search result, or an AI answer, will say about you.

Checking takes one command. The answer you want is 200 followed by text/html:

curl -s -o /dev/null -w "%{http_code} %{content_type}\n" https://your-api.example/

Caveats

This is one morning, 25 September 2026, and one directory. We counted hosts, not companies. A bare API host is no problem when the company’s main site explains the service, and some of the hosts answering 404 belong to exactly such companies. Some providers also register a separate host for each endpoint: 14 domains account for 436 hosts between them. Grouped by registered domain instead, 764 of 1,504 (51%) had at least one readable front page, so the picture barely moves.

We followed no redirects, so the 63 hosts that only redirect to themselves (from the bare domain to www, or from / to a language path) were never opened and may well have a page. A few hosts were preview deployments or the same service under several names. And the Bazaar holds only the services that registered there; x402 services outside it were not measured.