How much does a remote-file-hash call cost?

$0.003 per call, paid in USDC on Base via x402, with no account and no API key.

What does remote-file-hash return?

A JSON object with 4 top-level fields: source_url, bytes, algorithm and hash. The example on this page is a real call over archives/bundle.zip.

What happens when a remote-file-hash call fails?

The tool answers with a typed JSON error from the errors table. Payment is settled only after the tool has produced its result; a call that fails inside the tool is never settled. A 503 upstream_unavailable can follow a settled call; the x402 payments guide covers it, 429, 402 and an uncertain 500.

catalogue / tools / Archives & binary / Remote File Hash API

Remote File Hash API

Computes the sha256, sha1 or md5 digest of a remote file, buffered in memory under a size cap, for checksum verification.

Endpoint: POST /v1/remote-file-hash
Price: $0.003 per call
Family: Archives & binary
Docs: /docs/remote-file-hash

01When to use it

Verifying an artefact against a published checksum means pulling the whole file through a hardened fetch and hashing it. An agent that fetches the URL itself walks past every SSRF control and pays the bandwidth anyway.

When not to use it

The input is over 100 MB (104,857,600 bytes): remote-file-hash answers too_large (413).
The destination needs more than 60 s to answer: the call ends with upstream_timeout (424).
The destination is on a private or local network: the network guard refuses it with blocked_target (403).

02Parameters

Field	Type	Required	Description
url	string	yes	Absolute http(s) URL of the file, up to 2048 characters; redirects are followed and the digest is taken over the whole response body (after any HTTP content-encoding is decoded), which must be at most 100 MB.
algorithm	string	no	Digest to compute over the bytes: sha256 (default), sha1 or md5, returned as lowercase hex. One of: "sha256", "sha1", "md5". Default: "sha256".

03Limits

Limit	Value
Size cap	100 MB (104,857,600 bytes)
Timeout	60 s

04Example

The published example of remote-file-hash, verbatim: the request body and the response it returns.

Request

POST /v1/remote-file-hash
content-type: application/json
payment-signature: <base64 x402 payload>

{
  "url": "https://grist.tools/samples/archives/bundle.zip",
  "algorithm": "sha256"
}

Response

200 OK
payment-response: <base64 settlement receipt>

{
  "source_url": "https://grist.tools/samples/archives/bundle.zip",
  "bytes": 639,
  "algorithm": "sha256",
  "hash": "07af68ae7f049cf267c89c4c89df15fd1f59153773b308ea6bb7bb0d0585e5c3"
}

Sample file: archives/bundle.zip. Tiny zip of five entries (a stored greeting, a deflated markdown note, a deflated five-row CSV and two directories), built with jszip at a pinned entry date.

Response field	Type	In the example
source_url	string	"https://grist.tools/samples/archives/bundle.zip"
bytes	number	639
algorithm	string	"sha256"
hash	string	a string of 64 characters

05Call it from code

JavaScript

// remote-file-hash: $0.003 per call, paid in USD Coin on eip155:8453 via x402
// Install: npm install @x402/fetch@2 @x402/evm@2 viem@2
// Save as client.mjs (ES module, Node 18+), export EVM_PRIVATE_KEY with the paying wallet's key in your shell, then run: node client.mjs
// The wrapper reads the 402 (payment-required), signs and retries with payment-signature.
import { wrapFetchWithPayment, x402Client, decodePaymentResponseHeader } from '@x402/fetch'
import { ExactEvmScheme } from '@x402/evm/exact/client'
import { privateKeyToAccount } from 'viem/accounts'

const account = privateKeyToAccount(process.env.EVM_PRIVATE_KEY)
const client = new x402Client().register('eip155:8453', new ExactEvmScheme(account))
const fetchWithPayment = wrapFetchWithPayment(fetch, client)

const body = {
  "url": "https://grist.tools/samples/archives/bundle.zip",
  "algorithm": "sha256"
}

const res = await fetchWithPayment('https://grist.tools/v1/remote-file-hash', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify(body),
})
console.log(res.status, await res.json())
const settle = res.headers.get('payment-response')
if (settle) console.log(decodePaymentResponseHeader(settle).transaction)

Python

# remote-file-hash: $0.003 per call, paid in USD Coin on eip155:8453 via x402
# Install: pip install "x402[requests,evm]>=2.24,<3"
# The session reads the 402 (payment-required), signs and retries with payment-signature.
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http import decode_payment_response_header
from x402.http.clients.requests import x402_requests
from x402.mechanisms.evm.exact import register_exact_evm_client
from x402.mechanisms.evm.signers import EthAccountSigner

account = Account.from_key(os.environ["EVM_PRIVATE_KEY"])
client = x402ClientSync()
register_exact_evm_client(client, EthAccountSigner(account), networks="eip155:8453")
session = x402_requests(client)

payload = {
    "url": "https://grist.tools/samples/archives/bundle.zip",
    "algorithm": "sha256"
}

res = session.post("https://grist.tools/v1/remote-file-hash", json=payload)
print(res.status_code, res.json())
settle = res.headers.get("payment-response")
if settle:
    print(decode_payment_response_header(settle).transaction)

curl

# remote-file-hash: $0.003 per call, paid in USD Coin on eip155:8453 via x402
# 1. Unpaid call: HTTP 402, the requirements in the payment-required header (base64 JSON) and in the body.
curl -i -X POST 'https://grist.tools/v1/remote-file-hash' -H 'content-type: application/json' -d '{"url":"https://grist.tools/samples/archives/bundle.zip","algorithm":"sha256"}'

# 2. Same call with the signed payment (an EIP-3009 authorization, EIP-712 signed: it cannot be
#    typed by hand). x-payment is accepted as the v1 alternative. HTTP 200 carries payment-response.
curl -i -X POST 'https://grist.tools/v1/remote-file-hash' -H 'content-type: application/json' -H 'payment-signature: <base64 x402 payload>' -d '{"url":"https://grist.tools/samples/archives/bundle.zip","algorithm":"sha256"}'

06Errors

Code	HTTP	For this service
invalid_input	400	The body does not match the schema; its fields are url and algorithm.
blocked_target	403
unreachable_target	424
upstream_timeout	424
too_large	413
unprocessable	422
internal	500

Input that is rejected before the tool runs (malformed JSON, schema mismatch, body over the size limit) is never charged.

When each code is raised, and what it means for payment: /docs/remote-file-hash.

07Questions

How much does a remote-file-hash call cost?: $0.003 per call, paid in USDC on Base via x402, with no account and no API key.
What does remote-file-hash return?: A JSON object with 4 top-level fields: source_url, bytes, algorithm and hash. The example on this page is a real call over archives/bundle.zip.
What happens when a remote-file-hash call fails?: The tool answers with a typed JSON error from the errors table. Payment is settled only after the tool has produced its result; a call that fails inside the tool is never settled. A 503 upstream_unavailable can follow a settled call; the x402 payments guide covers it, 429, 402 and an uncertain 500.