Who is behind this wallet? How to check an x402 seller

Every x402 payment ends at a payTo address. CoinGecko's price endpoint, for example, answered on October 31, 2026 with 0x110cdBba7FE6434Ec4CE3464CC523942ad6Fb784 on Base. That string is the only part of the seller that will ever be on chain.

For the agent it is enough to pay. For everyone after the agent it is not. Your accountant needs a supplier name, compliance needs to know the money did not go to a sanctioned party, and you want to be sure the wallet in the 402 answer really belongs to the company on the website. This guide shows how to check, from quick to thorough.

Why it matters

Check 1: does the payTo stay the same?

Call the endpoint a few times without paying, on different days and on a few different endpoints of the same seller. Unpaid calls cost nothing. A serious seller pays to one address per network, or to a small and stable set.

Some sellers do have several. CoinGecko's answer named the same address for Base and Polygon and a different one for Solana. That is normal. What is not normal: an address that changes between calls, or one that differs from what the seller's own documentation says. In both cases, stop.

Check 2: does the seller's domain claim the wallet?

The 402 answer comes from the seller's server, so it already links the wallet to that host. These signals are stronger, from good to best.

Only the last one proves that the people behind the website also control the key. Ask the seller for it. A plain text such as "This address receives x402 payments for example.com, 31 October 2026", signed with the wallet's "sign message" function (EIP-191), can be checked by anyone. In code, viem's verifyMessage does it in one call and also handles smart contract wallets, which sign under EIP-1271 and need a chain lookup to verify. A small transfer of an agreed amount from the wallet works as proof too, if the seller cannot sign messages.

Check 3: who owns the domain?

Now tie the website to a legal entity.

Imprint and terms. Companies in Germany and Austria have to publish an imprint with name, address and register number. Elsewhere, the terms of service usually name the company you contract with.

Company register. Look the company up in the official register of its country: the German Handelsregister (free of charge since August 2022), Companies House in the UK, ACRA in Singapore, or the business registry of the US state where it is incorporated. Check that name, address and status match the website.

VAT ID. For companies in the EU, check the VAT ID in the European Commission's VIES service. A valid VAT ID also tells you the seller is a business, which matters for the reverse charge.

Check 4: what does the chain say?

Chain data does not tell you who owns a wallet. It does show how the wallet behaves.

Check 5: write it down

Whatever you find, record it with a date: wallet, network, company, country, how you linked them and when. Your accountant and your auditor need that record, and it is how you notice later that a seller's payTo has changed.

Then turn it into a rule for your agents: pay only wallets that passed these checks, and send anything new to a person first. Many agent wallets support an allowlist or a spending limit per recipient.

Doing it for more than a few sellers

For three sellers this is an afternoon of work. For thirty it becomes a job that never ends, because wallets and companies change.

That is what the 402lounge Register is for. It maps wallets to companies, with a level that says how far the link is proven: listed (0), wallet proven by signature or a small payment (1), legal entity verified (2). The lookup is free, on the website and for agents over MCP. Paste any payTo into the Register to see what is known about it.