Seller guide · November 2026

Prove your x402 payTo is yours.

Frits Zwager, Fizzl · 4 November 2026 · x402 Doctor, named below, is ours

An AI agent about to pay an x402 endpoint sees one address: the payTo in the 402. It can't tell whether that address belongs to the seller, or whether someone swapped it in, copied the seller's page, or runs a look-alike server. A Concordium badge closes that gap. It ties your endpoint to an agent in Concordium's Agent Registry, owned by an account with a verified identity, and says which wallet and which key are that agent's.

We did every step below for x402 Doctor itself on 4 November 2026: it is agent #5120 on mainnet, and its own payee check now says verified-external-key for its payTo on Base, X Layer and Monad.

What x402 Doctor checks

Before an agent pays, x402 Doctor's free payee check (and its paid preflight) does this for your endpoint:

Reads your agent card at /.well-known/agent-card.json and takes the Concordium badge from it.
Resolves the badge in the official registry. The badge's own contract decides mainnet (<10082,0>) or testnet; the card can't claim another chain.
Requires the agent to be Active, fetches the card at the on-chain agent_uri, and requires its SHA-256 to be the on-chain metadata_hash.
Requires that card to list your endpoint's origin. A copied card on another server fails here.
Gives each payTo an outcome: verified-wallet (a Concordium payTo is the agent's wallet), verified-external-key (an EVM payTo is the address of the key the agent bound with CIS-8), or mismatch, not-bound, revoked, card-mismatch or endpoint-unlisted.

The steps

You need a Concordium account with a verified identity, a few dozen CCD, the Concordium Wallet for Web in Chrome or Brave, and MetaMask with your EVM payTo account. Do it on a computer: on 4 November the Concordium mobile app over WalletConnect answered "Unsupported method" to the registry app, and the pin page needs the browser wallet.

1. Register your agent

In agent-registry.concordium.com, choose Mainnet and connect the browser wallet. Register Agent, type Native, Metadata URL your card's address (https://your-host/.well-known/agent-card.json), then Sign & Register. The wallet shows CIS-8004.register on contract 10082 (0); for us it was a free, sponsored transaction. Your agent appears under My Agents with an Agent ID.

2. Put the badge in your card

The badge is the agent's CIS-2 token address in its short form. The registry app's Agent ID is a longer form of the same address; the pin page turns one into the other when you press Check. Add the badge extension to your card, and make sure the card lists your endpoint's origin in url, services[].endpoint or supportedInterfaces[].url:

"capabilities": {
  "extensions": [{
    "uri": "https://docs.concordium.com/a2a-extensions/concordium-badge/v1",
    "required": false,
    "params": {
      "tokenAddress": "ccd:9dd9ca4d19e9393877d2c44b70f89acb/cis-2:<your badge>",
      "owner": { "account": "ccd:9dd9ca4d19e9393877d2c44b70f89acb:<your account>" },
      "agentWallet": "ccd:9dd9ca4d19e9393877d2c44b70f89acb:<your account>",
      "contracts": {
        "cis8004": "ccd:9dd9ca4d19e9393877d2c44b70f89acb:10082.0",
        "cis8": "ccd:9dd9ca4d19e9393877d2c44b70f89acb:10081.0"
      },
      "verification": {
        "service": "Concordium Agent Registry",
        "verifyUrl": "https://agent-registry-mcp.concordium.com/v1/badge-check/<your badge>"
      }
    }
  }]
}

A card shows one badge. Serve it byte for byte from a file: its hash goes on chain in the next step.

3. Pin the card

On x402-doctor.fizzl.eu/concordium-agent.html, enter the badge (or the Agent ID) and your card's URL, press Check, then Connect and sign. The browser wallet signs setAgentURI with your card's SHA-256 (about 15.6 CCD for us). The page waits for Concordium's own badge check and should end with "Pinned: the badge is valid."

4. Bind your EVM payTo (optional, but this is what verifies a Base payTo)

First link the key in the registry app: Register Agent → Cross-Chain → your chain (Base) → Connect Wallet with MetaMask on your payTo account → Prove Ownership → Link Key. When it says "Key linked. Now Sign & Register", stop: Sign & Register would create a second agent. Close the window, go back to the pin page and press Find my key and bind it. MetaMask signs one message to show your public key (no transaction), and the browser wallet signs setExternalReference (about 28.1 CCD for us). One bound key covers that address on every EVM chain you are paid on.

5. Check it

Concordium's own check: https://agent-registry-mcp.concordium.com/v1/check-badge/<your badge> should say "badge_valid": true with no issues.
x402 Doctor's free payee check on your paid URL, on x402-doctor.fizzl.eu or as the MCP tool x402_payee_check: each EVM payTo should read verified-external-key.
Or ask an agent: the free MCP tool concordium_badge_check on https://x402-doctor.fizzl.eu/mcp/free takes the badge or the registry app's Agent ID and returns valid with any issues, the owner, the origins your card lists and the CIS-8 key with its address and whether it is still bound.

Mistakes we made, so you don't

An empty badge field on the pin page gave a cryptic JSON error. Fixed on 4 November: it now says what to fill in, and accepts the registry's Agent ID.
The mobile wallet. WalletConnect from the Concordium app failed with "Unsupported method"; the browser wallet worked first time.
Changing the card after pinning breaks the badge (hash mismatch) until you pin again. Between our card update and the pin, Concordium's check reported exactly that.
Sign & Register in step 4 would mint a second agent. Stop at "Key linked".

What it doesn't cover

A badge vouches for Concordium and EVM payTos. Doctor reports a payTo on Solana, the XRP Ledger, Algorand or Stellar as not-bound (the agent's CIS-8 key is for EVM). For those, an ERC-8004 registration with delegations, which Doctor also reads, is the way today. And a badge says who gets paid, not whether the seller delivers: x402 Doctor's preflight looks at that separately.

Questions

How does an AI agent know an x402 payTo really belongs to the seller?

It can't from the 402 alone: anyone can copy a seller's page or swap the address. With a Concordium badge, the seller's agent card names an agent in Concordium's Agent Registry, owned by an identity-verified account, and the card's hash is pinned on chain. x402 Doctor checks that the payTo is that agent's wallet or a key the agent bound with CIS-8, before the agent pays.

What does a Concordium badge cost a seller?

On 4 November 2026 registering x402 Doctor's own agent was free (a sponsored transaction), linking the Base key was free, pinning the card cost about 15.6 CCD and binding the key about 28.1 CCD: about 44 CCD, roughly €0.10. You need a Concordium account with a verified identity.

Which payTo addresses can a badge cover?

A Concordium payTo when it is the agent's wallet, and an EVM payTo (Base, X Layer, Monad and other EVM chains) when its key is bound to the agent with CIS-8. A payTo on Solana, the XRP Ledger, Algorand or Stellar shows as not-bound: the badge doesn't vouch for it.

What happens when I change my agent card?

The badge breaks until you pin again: the card's SHA-256 must equal the metadata_hash on chain. Serve the card byte for byte from a file and run the pin step after every change.

Does x402 Doctor hold my keys?

No. Every transaction is signed in your own wallets: the Concordium Wallet for Web and, for the EVM key, MetaMask, which signs one message to show the public key (no transaction).