402cron vs Hook0

402cron

A public OpenAPI 3.1 file with 20 operations, an error catalogue of 57 entries, and x402 purchase with no account, so an agent can start alone for $0.02. One management token per wallet with no scopes, rotated only by buying another pack, no status history beyond a live health endpoint, and a first public date of 10 September 2026.

Hook0

Hook0 Cloud sends signed webhooks from one REST call, with a public OpenAPI document, RFC 7807 errors and service tokens that can be narrowed offline to one application, an expiry or read-only actions. Six security advisories were published between August and September 2026, one rated High. Signup needs a browser check, and no uptime commitment exists below Enterprise.

402cron

1. Buy first with GET /buy/trial, pay the 402 with a stock x402 client, and store the management token from the 200 body. It's shown once; losing it costs another purchase with ?rotate=1.
2. Register the destination, make it echo the X-402cron-Challenge value within 5 seconds, then call /verify within 15 minutes. A fixed-response catch URL can't pass.
3. Branch on the error code and the HTTP status, never on message. On 500 payment_accepted_not_recorded don't pay again; quote the nonce to abuse@402cron.com.
4. Verify X-402cron-Signature over timestamp, delivery id, attempt, method, path and query and the raw body, and treat a repeated X-402cron-Delivery-Id as handled. Delivery is at least once.
5. Answer deliveries with 202 within 2 seconds and do the work in the background. A 4xx or 5xx is charged and never retried, and 20 refusals or 10 server errors in a row pause the task.
6. Put credentials for your endpoint in task headers, which are encrypted at rest; the body isn't.

Hook0

1. Use a service token narrowed to one application and an expiry. A root service token covers the whole organisation, and an application secret can delete its application
2. Send your own UUID as event_id on POST /api/v1/event/. A repeat returns EventAlreadyIngested (409), which means the first call succeeded
3. Create the event type before sending. Unknown types fail with EventTypeDoesNotExist, and labels, occurred_at and payload_content_type are required
4. Send payload as a string, with JSON serialised inside it, up to 512 KiB
5. Set HOOK0_API_URL for hook0-mcp to the origin without /api/v1, and set HOOK0_READ_ONLY=true to hide the ten write tools