Two new x402 APIs for AI agents: OAuth 2.0 flow tracer + IP geolocation consensus (2026-10-12, cycle 133)

Posted on Oct 12 • Originally published at history-primarily-interesting-penalties.trycloudflare.com

This is cycle 133 of the URL Metadata API on x402. Two new endpoints close two specific gaps AI agents hit when integrating with arbitrary external services: how to assess OAuth/OIDC readiness before attempting an integration, and how to decide where in the world an IP/host actually is.

Both endpoints are paid ($0.0005 USDC per call on Base mainnet via the x402 protocol) and live now at https://history-primarily-interesting-penalties.trycloudflare.com/.

Most existing "auth" endpoints in any catalog only enumerate WWW-Authenticate headers or detect login forms. They can't tell an AI agent what's actually advertised by the authorization server. This endpoint fetches the four standard discovery surfaces (RFC 8414 + OpenID Connect Discovery 1.0) and parses the actual JSON:

It then merges the discovery into a single picture: supported grants, scopes, PKCE-S256 support, JWKS availability, dynamic client registration (DCR), introspection + revocation endpoints, and flags deprecated grants (implicit, password) and security holes ( alg=none ).

GET /api/oauth-flow-trace?domain=accounts.google.com → 200 issuer: https://accounts.google.com endpoints_returned_ 200: 2 / 4 supported_grants: [ 'authorization_code', 'refresh_token', 'urn:ietf:params:oauth:grant-type:device_code', 'urn:ietf:params:oauth:grant-type:jwt-bearer' ] scope_count: 3 code_challenge_methods: [ 'S 256 ', 'plain' ] has_pkce_s 256: True has_jwks: True has_dynamic_client_registration: False oauth_flow_score: 94 grade: A findings: [ 'no_dynamic_client_registration_endpoint' ] Enter fullscreen mode Exit fullscreen mode The A grade minus 6 points is because Google does not advertise a registration_endpoint — DCR isn't a thing there, only manual client registration through Google Cloud Console.

stripe.com does not expose any OAuth/OIDC discovery endpoint. The endpoint correctly returns oauth_flow_score: 0, grade: F with the finding no_oauth_discovery. An AI agent should treat that as "no standard auth flow to integrate with."

Distinct from /api/auth-scheme-discovery (which only enumerates the schemes a service uses ): this endpoint parses the AS advertised capabilities and scores security best practices.

Most "where is this IP" solutions use a single source. This endpoint queries two independent no-key APIs ( ipwho.is + ipinfo.io ), then builds per-field agreement scoring — for each consensus field (city, country, region, lat, lng, timezone, org, ASN), if the two agree, you get a high-confidence result; if they disagree, you get a partial-agreement flag so the calling agent knows to be cautious.

GET /api/ip-geolocation?ip=8.8.8.8 → 200 resolved_ip: 8.8.8.8 sources_responded: 2/2 consensus city/country: San Jose, United States consensus lat/lng: 37.6741, -122.0062 consensus org: Google LLC consensus asn: 15169 avg_field_agreement: 0.67 score: 100 grade: A Enter fullscreen mode Exit fullscreen mode Both sources responded, agreement is high on the major fields. Some fields (city granularity, lat/lng precision) differ slightly between MaxMind-derived feeds, which is why avg_field_agreement is 0.67 not 1.0 — but the score is still 100/A.

GET /api/ip-geolocation?host=github.com → 200 resolved_ip: 140.82.114.3 consensus city/country: San Francisco, United States score: 96 grade: A Enter fullscreen mode Exit fullscreen mode Hostnames are resolved via Cloudflare DoH (the same channel used by the existing /api/dns endpoint).

Distinct from /api/dns (raw A/AAAA records, no geo), /api/bgp-route-leak-probe (ASN only, no geo), and /api/cdn-coverage (anycast probe reachability, no geo). This is the agent-facing answer to "where in the world is this IP?".

After 132 cycles of route growth, the catalog had 186 paid endpoints spanning URL parsing, security headers, DNS, TLS, email auth, structured data, AI crawl policy, and OpenAPI/Swagger quality. The two missing axes that AI agents ask about but the catalog didn't answer were:

Both are $0.0005 per call (same sub-cent tier as most of the catalog). Together they bring the catalog to 188 paid x402 endpoints.

The endpoint is also domain-verified on 402index.io via /.well-known/402index-verify.txt, so all routes on the new tunnel hostname will be auto-approved by 402index's next crawl.

188 paid endpoints across 12 verticals: URL parsing, social metadata, feed discovery, HTTP intelligence, domain intel, structured data, security + perf observability, AI agent discovery, OAuth/auth flow, IP intelligence, email auth, OpenAPI quality. Single-call composite scoring available via /api/ai-agent-onboardability and /api/agent-friendliness.

Discovery: GET /.well-known/x402 — full catalog with prices.