What is x402? HTTP 402 payments for AI agents vs AP2 and ACP

x402 is an open payment standard that lets an AI agent or any program pay for something on the web inside a normal HTTP request. A server answers an unpaid request with status code 402 Payment Required plus a price, the client signs a payment (usually in a stablecoin such as USDC), retries the same request with that payment attached, and gets the data back. No account, no API key, no checkout form.

If you want ideas like these working inside your own business, see our AI development and automation service.

Below: the exact request flow, who governs the standard as of November 2026, and how it differs from Google's AP2 and the OpenAI and Stripe ACP. If you want the wider map of every agent commerce protocol, our overview of UCP, ACP, AP2 and MCP and which one your store needs covers the full stack. This article goes deep on the payment layer only.

What does HTTP 402 Payment Required mean?

HTTP 402 is a status code that was set aside decades ago for paid access and never given a standard meaning. The current HTTP specification, RFC 9110, still says only this: "The 402 (Payment Required) status code is reserved for future use."

What was missing was an agreed format for the price and an agreed way to send proof of payment back. x402 supplies both. If you want a refresher on how requests, responses and status codes work in the first place, our beginner's guide to REST APIs explains the basics.

How does x402 work, step by step?

x402 works as a challenge and retry loop on a single URL. The x402 specification on GitHub describes the typical flow like this:

1. The client (an agent, a script, an app) sends a normal request, for example GET /weather.

2. The server has no payment on file for that request, so it replies 402 Payment Required with a PAYMENT-REQUIRED header. That header holds Base64 encoded JSON listing what the server accepts: the scheme, the network, the price and the address that should receive the money.

3. The client picks one of the accepted options and builds a signed payment payload for that scheme and network.

4. The client retries the same request, this time with a PAYMENT-SIGNATURE header carrying the payload.

5. The server checks the payment, either itself or by sending it to the /verify endpoint of a facilitator.

6. If the payment is valid, the server does the work. If not, it returns another 402.

7. The server settles the payment, again either directly onchain or through the facilitator's /settle endpoint, which submits the transaction and waits for confirmation.

8. The server returns 200 OK with the data, plus a PAYMENT-RESPONSE header containing the settlement result.

Steps one and two are optional: a client that already knows the price can pay on the first request.

What is a facilitator?

A facilitator is a service that verifies and settles payments so the API owner does not have to run blockchain infrastructure. The spec defines it as "a server that facilitates verification and execution of payments for one or many networks." It cannot move money on its own: one of the stated principles is that no scheme may let the facilitator or server move funds "other than in accordance with client intentions."

Coinbase runs the best known one. Its CDP Facilitator docs list the first 1,000 onchain transactions each month as free and $0.001 per transaction after that, and state that it has processed more than 100 million transactions and $28 million in payment volume across Base and Solana. You can also run your own facilitator or verify inside your own server; the repo warns against using the public x402.org facilitator for mainnet production.

What are x402 schemes?

A scheme is the rule for how money moves. As of November 2026 the spec lists three:

• exact charges a fixed amount, for example one cent per API call.

• upto authorises a maximum per request, and the seller settles only what was actually used. Useful for metered work like model inference.

• batch-settlement (EVM chains) uses escrow and signed vouchers held off chain, so a seller can redeem many tiny charges in one onchain batch instead of settling every request separately.

A worked example: an agent buying weather data

Picture a travel agent built on a language model that needs a forecast from a paid weather API priced at one cent per call.

The agent calls GET /forecast?city=Lisbon. The API returns 402 with a header saying, in effect: scheme exact, network Base, price $0.01 in USDC, pay to this address. The agent's wallet has an owner set rule: no call above five cents, no more than two dollars a day. One cent passes, so the wallet signs the payment and the agent repeats the request with PAYMENT-SIGNATURE attached. The API forwards the payload to its facilitator, gets a valid verdict, returns the forecast, and the facilitator settles the cent onchain.

For the agent this is one extra HTTP round trip. For the API owner it is one paymentMiddleware call that maps a route to the payment options it accepts.

The agent never signed up, stored an API key or prepaid credits. That is the pitch, and it is why the wallet's spending rules matter: nothing else stands between a confused agent and a long run of small payments.

Who is behind x402?

x402 was started at Coinbase and is now governed by the x402 Foundation under the Linux Foundation. The Linux Foundation announced the operational launch on 14 July 2026, with Coinbase completing its contribution of the protocol. The original coinbase/x402 GitHub repo now says it is a development fork and points to the foundation's repo.

The announcement says 40 organisations have joined since the April 2026 intent to launch. Premier members include Adyen, Amazon Web Services, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Monad Foundation, MoonPay, Ripple, Shopify, Solana Foundation, Stellar Development Foundation, Stripe and Visa.

Stripe is a practical on ramp: its docs show an x402 challenge paying into a Stripe deposit address, with the settled payment recorded as a normal PaymentIntent, for USDC on Base, Solana and Tempo.

What is the status of x402 as of November 2026?

x402 is live and in production use. The foundation's own FAQ calls it "production ready," says it has "processed millions of transactions," and says the code is open source and has been audited. Official SDKs include TypeScript, Python and Go, with network packages for EVM chains, Solana, Stellar, Aptos, Hedera and others, and a package for MCP.

Two caveats. Stablecoins are the main payment method today; the spec aims to add fiat networks but says it "will never deprioritize onchain payments in favor of fiat payments." And the dollar totals are small: $28 million across more than 100 million transactions is well under a dollar each. That fits the design. x402 is strongest at tiny, frequent payments for data and compute, not at selling sofas.

x402 vs AP2 vs ACP: what is the difference?

They solve different problems and can stack in one purchase. Ask what question each one answers.

x402: how does the money move?

x402 is the payment rail. It defines how a price is quoted and how proof of payment travels inside HTTP. It says nothing about carts, shipping, returns or whether a human approved the spend. Best fit: paid APIs, pay per request data, metered AI compute, content paywalls, one agent paying another.

AP2: did a human really authorise this?

The Agent Payments Protocol (AP2) is Google's answer to the trust question. Its docs frame the gap as proving a user gave an agent authority for a specific purchase. AP2 does this with cryptographically signed objects called mandates. A Checkout Mandate covers what is being bought; a Payment Mandate authorises a specific payment instrument. Each can be "open" (the user's limits, like a budget) or "closed" (a final, specific transaction).

AP2 was announced in September 2025. On 28 April 2026 Google released AP2 v0.2, adding "Human Not Present" payments, and donated the protocol to the FIDO Alliance, where standardisation continues. AP2 runs as an extension to Google's Agent2Agent protocol and to UCP. Importantly, AP2 is payment method agnostic: its own sample gallery includes a "Human Not Present x402" scenario. AP2 can prove the user said yes, and x402 can then move the money.

ACP: how does an agent check out from a merchant?

The Agentic Commerce Protocol (ACP) is maintained by OpenAI and Stripe and covers the shopping flow: a checkout API that agents call, plus a delegated payment spec that passes a scoped payment token instead of raw card details. The merchant stays merchant of record and keeps control of which products are sold, how they are presented and how orders are fulfilled. As of November 2026 the repo still marks the spec as beta, with 2026-04-17 as the latest stable version. OpenAI was the first platform to implement it, in ChatGPT, and Stripe was the first payment provider, through its Shared Payment Token.

Where does MCP fit?

MCP, the Model Context Protocol, is how an agent discovers and calls tools. It is not a payment protocol at all. Search Console shows people typing "ap2 vs mcp vs x401" (the 401 is a typo for 402), but the three are not rivals. A tool exposed over MCP can sit behind x402, so the agent pays per call; ACP's latest spec lists MCP in its scope; AP2's docs describe it as an open extension for A2A and MCP. MCP is the phone line; the others are what is said on the call.

Which one should you use? A decision rule

Start from what you sell and who is buying.

• You sell an API, dataset or compute by the call, and the buyer is software. Use x402. Nothing else on this list is designed for one cent payments without accounts.

• You sell physical goods or anything with a cart, shipping and returns, and want to appear inside ChatGPT. Use ACP, most likely through Stripe if that is your processor.

• You are building the agent, and it spends a user's money while they are not watching. Look at AP2 mandates for the proof of consent, whatever rail settles the payment.

• You expose tools to agents. Use MCP for the interface, and add x402 if those tools should be paid.

• You run a store and are unsure agents can reach you. Fix discovery first. Run our free agentic commerce checker and read why many sites accidentally block AI shopping agents in robots.txt.

When we build agents at AISmith, the payment protocol is rarely the hard part. The spending policy is: caps, allowed merchants, and an audit log a human can read. If you want help wiring a paid API or an agent that spends safely, that is the kind of work our AI agents and automation team does.

Key takeaways

• x402 turns the unused HTTP 402 status code into a working payment step: request, 402 with a price, signed payment, retry, 200 with data.

• It is governed by the x402 Foundation under the Linux Foundation since July 2026, with 40 member organisations including Coinbase, Google, Stripe, Visa and Mastercard.

• Stablecoins are the main payment method today, and the model suits small, frequent payments for APIs and compute.

• AP2 proves a user authorised a purchase; ACP runs merchant checkout; MCP is how agents call tools. They complement x402 rather than replace it.

• The real risk sits in the agent's wallet rules, not the protocol. Set hard spending limits before going live.

For the bigger picture on how much buying agents actually do today, see what the numbers say about agentic commerce in 2026.

Frequently asked questions

Is x402 a cryptocurrency or a token?

No. x402 is a protocol, a set of rules for how a price and a payment travel inside HTTP. It has no token of its own and the foundation charges no protocol fee. Payments today are mostly made in existing stablecoins such as USDC on networks like Base and Solana.

Do I need a crypto wallet to accept x402 payments?

You need an address that can receive the payment, but not a wallet you manage by hand. Coinbase lets sellers receive into custodial or self custody wallets, and Stripe can issue a deposit address and show each payment in your dashboard. A facilitator handles verification and settlement.

What does x402 cost?

The protocol is free; you pay the network's transaction fee and any facilitator fee. Coinbase's facilitator is free for the first 1,000 onchain transactions per month and $0.001 each after that, as of November 2026. You can also self facilitate inside your own server.

Can x402 be used with MCP servers?

Yes. The official SDK includes an @x402/mcp package: a paid tool returns a payment requirement, the agent pays, and the call goes through. It is a natural fit, because MCP tools are already called by software rather than people.

Is x402 safe for agents to use?

The protocol is designed so neither the server nor the facilitator can move funds beyond what the client signed. The bigger risk is an agent that pays for things it should not, so put spending caps and allow lists on the agent's wallet. For how identity and permissions work more generally, our guide to user authentication from first principles is a good primer.