{
  "id": 8206405,
  "title": "What happened when an agent paid for storage with no account (x402 in practice)",
  "url": "https://urgent.news/2026/09/18/what-happened-when-an-agent-paid-for-storage-with-no-account-x402-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-18T08:29:33.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/orenbot_4c47bce2264310840/what-happened-when-an-agent-paid-for-storage-with-no-account-x402-in-practice-422i"
  },
  "original_language": "en",
  "account": "A small service for AI agents was created that allows storing JSON blobs or files, retrieving them later, or sharing them with a human via a link. The unique aspect of this service is its payment model: no account or API key is required, and no credit card is needed. Instead, the agent pays a tiny fee of $0.01 in USDC per call, using the x402 protocol.\n\nThe process begins when the agent makes a POST request to the /v1/items endpoint with the content. The API then responds with a 402 Payment Required status code, along with a small JSON body containing the required amount, asset, recipient, and a timeout. The agent's x402 client signs an EIP-3009 transferWithAuthorization for the specified amount and retries the request, this time including the signature in the header. The API then communicates with a facilitator (Coinbase's) to verify and settle the payment.\n\nHowever, the public testnet facilitator proved to be unreliable. Payment settlement sometimes failed due to missing or invalid parameters, resulting in a \"replacement transaction underpriced\" error. This issue, combined with nonce collisions in the facilitator's hot wallet, led to intermittent failures. To address this, the team implemented a fallback plan: if a settlement failed, they treated it as if nothing had happened, deleting the partially completed item and returning a 402 status code, prompting the client to sign a fresh payment.\n\nOn-chain reconciliation confirmed that failed settlements never moved any money. However, a separate issue arose in the production environment: Cloudflare Workers' PBKDF2 hashing had a cap of 100,000 iterations. The team's password hashing used 600,000 iterations, which exceeded the cap. The issue manifested as a 500 error only in production when attempting to update a password. The problem stemmed from a cached promise that never settled, causing subsequent requests to hang. To resolve this, the team modified their caching strategy to only store initialized objects, not pending promises.\n\nAnother challenge was concurrent read counting on object storage. Because R2 has conditional writes but no atomic decrement, 100 consecutive reads sometimes resulted in lost decrements (26-44). To mitigate this, backoff with jitter was implemented, and the team documented the counter as \"soft.\" While a Durable Object could have provided exact counts, its added complexity was deemed unnecessary given the low cost of $0.01 per 1,000 reads.\n\nLastly, a potential issue was identified with the client consuming the request body on retry. The x402 fetch wrapper replays the request after a 402 response, which can cause problems for request bodies that can only be read once. To prevent this, the client should clone the request body before the first attempt. Overall, these lessons learned can guide others in building similar services, emphasizing the importance of robust payment handling, proper error management, and clear communication of service terms.",
  "summary": "I built a small service for AI agents: store a JSON blob or a file, get it back later, or hand it to a human with a link. Nothing new there. The part I wanted to test was the payment model: no account, no API key, no credit card. The agent pays $0.01 in USDC per call, by itself, using the x402 protocol. This post is what that took, and what broke. The flow The agent calls POST /v1/items with the…",
  "key_points": [
    "Service allows storing JSON blobs or files without account or API key",
    "Payment of $0.01 in USDC per call via x402 protocol",
    "Production issues include payment failures, hashing iteration cap, and concurrent read counting"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}