x402 subgraph endpoint returns "auth error: malformed API key" instead of 402 challenge

[PaulieB14]

The documented x402 subgraph endpoints at https://gateway.thegraph.com/api/x402/subgraphs/id/{subgraph_id} are returning HTTP 200 with {"errors":[{"message":"auth error: malformed API key"}]} instead of the documented 402 Payment Required challenge with payment requirements. CC @tmigone

This makes the x402 path unusable today even though the code shipped in PR #1170 (Apr 15) and @graphprotocol/client-x402 shipped in graph-client PR #1016 (Apr 14). Suggests /api/x402/* routes are being directed through the API-key auth middleware rather than the x402 middleware in production.

Steps to reproduce

1. Raw curl

curl -X POST https://gateway.thegraph.com/api/x402/subgraphs/id/HMuAwufqZ1YCRmzL2SfHTVkzZovC9VL2UAKhjvRqKiR1 \
  -H "Content-Type: application/json" \
  -d '{"query":"{ tokens(first: 3) { symbol } }"}'

Expected: HTTP 402 with payment requirements per docs (network=base, asset=USDC, amount, recipient).

Actual: HTTP 200 with {"errors":[{"message":"auth error: malformed API key"}]}.

2. Official @graphprotocol/client-x402 CLI v1.0.0

export X402_PRIVATE_KEY=0x...   # wallet funded with 0.01 USDC on Base
npx graphclient-x402 "{ _meta { block { number } } }" \
  --endpoint https://gateway.thegraph.com/api/x402/subgraphs/id/HMuAwufqZ1YCRmzL2SfHTVkzZovC9VL2UAKhjvRqKiR1 \
  --chain base

Same response — "auth error: malformed API key". Tested against multiple subgraphs (Uniswap V3 Base HMuAwu..., Uniswap V2 Ethereum 5zvR82...) with identical results.

Other observations

• https://testnet.gateway.thegraph.com (referenced in the docs as the testnet base URL) does not resolve via DNS.
• The standard API-key endpoint https://gateway.thegraph.com/api/subgraphs/id/{id} works fine with a valid API key, confirming the underlying gateway is healthy.

Likely cause

/api/x402/* requests appear to be routing through the API-key auth middleware first, which rejects the request before the x402 middleware (src/middleware/x402_auth.rs) gets a chance to issue the 402 challenge.

Happy to test fixes against my wallet on Base mainnet.

[tmigone]

Hey @PaulieB14, x402 support is not yet deployed to production. Will get it deployed this week.

[Bortlesboat]

Fresh retest on April 28, 2026: still seeing the pre-deploy behavior.

Request:

POST https://gateway.thegraph.com/api/x402/subgraphs/id/HMuAwufqZ1YCRmzL2SfHTVkzZovC9VL2UAKhjvRqKiR1
content-type: application/json
{"query":"{ _meta { block { number } } }"}

Response was 200 with:

{"errors":[{"message":"auth error: malformed API key"}]}

No payment-required or x-payment-response header was present. I'll treat that as expected until the production x402 rollout lands; happy to retest once deployed.

[tmigone]

x402 has been deployed to production now.

Just bare in mind the SKILLS.md being served by the gateway has an issue that needs fixing here #1192, fix is not live yet.

@PaulieB14 the only relevant difference is that when using graph client you should donpx @graphprotocol/client-x402 ... instead of npx graphclient-x402 ...