x402 is an open standard for paying over HTTP. It revives the long-dormant 402 Payment Required status code so a server can quote a price and a client can pay for a gated resource inside an ordinary web request, with no checkout page and no human in the loop. It was built for machines: an AI agent or app asks for a page, dataset, API call, or product, receives a 402 stating the price and where to pay, pays, and retries with proof attached. On 14 July 2026 the Linux Foundation launched the x402 Foundation to steward the protocol, with 40 members including Google, Stripe, Visa, Mastercard, Cloudflare, and Coinbase.
This piece explains what x402 is, how its handshake works, who governs it, and where it sits relative to the Agentic Commerce Protocol and the card and stablecoin rails. Volatile specifics — membership, payment mix, adoption — are dated and attributed; the durable idea is HTTP-native payment.
What does x402 actually do?
x402 turns a web request into a payment request. HTTP has reserved the 402 Payment Required status code since the 1990s, but it sat unused for decades because there was no agreed way to state a price or settle a payment inside the protocol. x402 fills that gap: it standardises the small payload a server returns with a 402 — the price, the accepted asset, and where to pay — and the proof a client attaches when it retries.
The point is to let software pay software. A human buying a coffee doesn't need it; a fleet of agents each fetching a paid API a thousand times a minute does. Because the whole exchange happens inside normal HTTP, there is no redirect to a hosted checkout, no stored card, and no session for a person to click through. That makes it suited to the sub-cent, high-frequency payments that agents generate and cards can't economically carry.
How does the x402 handshake work?
In four steps, all inside one request-and-retry over ordinary HTTP:
| Step | What happens |
|---|---|
| 1. Request | A client (agent, app, or crawler) requests a gated resource — a page, dataset, API, or MCP tool. |
2. 402 challenge |
The server answers 402 Payment Required with a small payload: the price, the accepted asset, and where to pay. |
| 3. Pay | The client settles the amount — today typically a stablecoin such as USDC — often in under a second. |
| 4. Retry with proof | The client repeats the request with proof of payment attached; the server returns the resource. |
Source: x402 Foundation / Linux Foundation launch materials and Cloudflare's x402 documentation, mid-2026. Coinbase, which built x402, describes settlement costs as "less than a fraction of a cent," with stablecoin transactions clearing sub-second on chains such as Base. Because the flow is just HTTP, any server behind a compatible gateway can charge, and any client that speaks x402 can pay, without either side building a bespoke billing integration.
Who governs x402, and how big is it?
Since 14 July 2026, x402 is governed by the x402 Foundation under the Linux Foundation, with the protocol contributed by Coinbase and developed under vendor-neutral, open governance. At the operational launch the Foundation listed 40 members across payments, cloud, and blockchain.
The premier members are the tell: Adyen, Amazon Web Services, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, MoonPay, Ripple, Shopify, the Solana Foundation, the Stellar Development Foundation, Stripe, and Visa. Having the major card networks, two hyperscalers, and the leading stablecoin issuers at the same table is what separates x402 from a single-vendor experiment. Read the roster as evidence of serious backing, not of settled dominance — the standard is months old and its final shape is still being written.
x402 is not a wallet, a coin, or a checkout page. It is the missing verb in HTTP: a standard way for one machine to ask another for payment, and be paid, without a human clicking anything.
Cards or stablecoins — what does x402 settle in?
Both, in principle; mostly stablecoins today. x402 began as a stablecoin-native scheme — Coinbase built it around on-chain settlement (USDC on Base), which is why early live volume clears in stablecoins. Under the Linux Foundation, the standard is written to be payment-type-agnostic, spanning "traditional cards to stablecoins," so a card network can settle an x402 request just as a wallet can.
The economics explain the current tilt. According to a Keyrock report covered by CoinDesk in May 2026, agent activity on the x402 scheme ran to roughly 176 million payments with a median of $0.01–$0.10, and about 76% fell below the ~$0.30 card-fee floor — sub-cent territory where stablecoin settlement is economic and cards are not. Treat those figures as vendor-reported and directional. The durable point: x402 is the transport; the rail underneath can be a card or a stablecoin, and today it is mostly the latter.
Where does x402 sit next to ACP and the payment rails?
At a different layer from each. It helps to separate the stack an agent purchase actually moves through:
| Layer | Example | Job |
|---|---|---|
| Discovery / being chosen | Answer-engine optimisation | Whether an agent surfaces and picks your product at all |
| Checkout orchestration | ACP (OpenAI + Stripe) | Completing an order inside an assistant like ChatGPT |
| Payment request | x402 | The HTTP handshake that asks for, and confirms, payment for a resource |
| Settlement rail | Cards or stablecoins | Actually moving the money |
The Agentic Commerce Protocol orchestrates a full shopping order inside chat; Google's AP2 (Agent Payments Protocol) is a rail-agnostic agent-payment standard; the card networks and stablecoins are the rails that clear funds. x402 slots in as the payment-request handshake that can front any of them. None has converged into a single winner as of mid-2026, and a brand does not need to bet on one — the transaction layer is being built to be plural.
What does x402 mean if you sell or publish online?
Two things, and only one is about commerce. For merchants, x402 is plumbing you will likely accept rather than integrate by hand — the work that decides revenue still happens a layer up, at whether an agent chooses your product in the first place. For publishers and API owners, x402 is more novel: it makes charging an AI agent for access a real option, sitting between "allow every crawler free" and "block them." That is the pay-per-crawl model, and it changes the calculus of letting AI crawlers in.
Either way, the standard settles how an agent pays, not whether it picks you. Whether AI agents and answer engines actually surface and recommend your products is exactly what Buffy Intel measures, snapshot over snapshot. Questions: [email protected].