What is x402? HTTP 402 payments for AI agents explained

x402 is an open payment standard that lets a web server charge for an API call, file or page using the HTTP 402 Payment Required status code, and lets a client, often an AI agent, pay programmatically without an account, API key or checkout page. The server answers a request with 402 and its payment requirements, the client signs a payment and retries the request with it, and the server verifies and settles the payment, usually in a stablecoin on a blockchain, before returning the resource.

Coinbase created x402. The project now sits under the x402 Foundation, whose Technical Steering Committee lists Coinbase, Cloudflare and Stripe as participating organizations, and the standard is published under the Apache 2.0 license. x402 on GitHub, x402 Technical Steering Committee For where machine payments fit in the wider picture, see what agentic commerce is.

What is HTTP 402 Payment Required?

HTTP status codes tell a client what happened to its request: 200 for success, 404 for not found, 401 for authentication needed. Code 402 was set aside early and never given standard behavior. RFC 9110, the current specification of HTTP semantics, still says: "The 402 (Payment Required) status code is reserved for future use." RFC 9110, section 15.5.3

x402 gives the code a defined job. In x402, a 402 response tells the client that payment is required, describes the payment (amount, currency and destination), and supplies what the client needs to pay programmatically. x402 docs: HTTP 402 Because it reuses an ordinary status code and headers, any HTTP client and server can take part.

How does an x402 payment work?

Client requests a resource

An agent calls a paid API endpoint with an ordinary HTTP request.

No payment attached

Server returns 402

The PAYMENT-REQUIRED header lists accepted schemes, networks, price and pay-to address.

Client picks one option and signs a payload

Client retries with payment

The PAYMENT-SIGNATURE header carries the signed payment payload.

Server verifies, locally or through a facilitator

Is the payment valid?

If invalid402 again

The server returns payment requirements with an error and does no work.

If validWork done, payment settled

The server fulfills the request and settles directly or through a facilitator.

Settlement response

200 OK with PAYMENT-RESPONSE

The resource returns with a header describing the settlement outcome.

The first two steps are optional when the client already knows the price, and the timing of settlement depends on the payment scheme.

The x402 repository describes this twelve-step flow in detail, including the facilitator's /verify and /settle endpoints. x402 specification and flow on GitHub Version 2 of the protocol, dated December 2025, standardizes three headers. x402 docs: HTTP 402

A facilitator is a server that verifies and executes payments for one or more networks, so the resource server does not need to run blockchain infrastructure. Anyone can run one. The FAQ argues that a malicious facilitator cannot redirect funds because each payload is signed by the buyer and settled on chain. x402 FAQ

What are x402 payment schemes?

A scheme is the logic of how money moves. The documentation lists three:

• exact transfers a fixed amount, such as one dollar to read an article.
• upto authorizes a maximum and lets the seller settle actual usage, for example per generated LLM token. Each authorization can be settled once and is time-bound. x402 docs: upto
• batch-settlement has the buyer deposit into escrow once and sign off-chain vouchers per request, so the seller can redeem many small charges on chain in batches.

The specification repository also holds a draft auth-capture scheme, first drafted in May 2026, that adds hold, capture, void and refund operations. x402: auth-capture scheme draft Check whether your facilitator supports a scheme before you design around it.

How does x402 settle payments in stablecoins?

x402 identifies networks with CAIP-2 identifiers, such as eip155:8453 for Base, and supports EVM chains, Solana and a growing list of others. On EVM chains, tokens such as USDC that support EIP-3009 need a single off-chain signature, with Permit2 as the fallback for other ERC-20 tokens; the facilitator sponsors gas. A price written as a dollar string uses the chain's configured default stablecoin. x402 docs: networks and token support

The documentation separates protocol support from production support. The public x402.org facilitator is for testnet development and does not support Base mainnet, so a production service needs a production facilitator provider, its own facilitator, or self-facilitation. The README says x402 aims to support fiat as well as crypto networks, but the FAQ says it has no native fiat off-ramps or card deposits today. x402 FAQ

What is x402 used for?

The documentation names these uses: API services paid per request, AI agents that pay for API access on their own, paywalls for digital content, microservices billed by microtransaction, and proxy services that resell API capabilities. x402 docs: introduction

x402 also travels beyond plain HTTP. The specification has transport documents for MCP and A2A, and the AP2 repository includes x402 sample scenarios; what AP2 is explains how mandates can sit on top. Stripe's machine payments documentation names x402, alongside the Machine Payments Protocol, for paying per API call. Stripe: machine payments

What are the risks of x402 payments?

The protocol keeps payments simple by leaving several controls to the client and the seller:

• No chargebacks on exact. The FAQ calls exact a push payment that is irreversible once executed; refunds are a new transfer from the seller, unless a scheme defines refunds.
• Budgets are the client's job. The v2 specification lists client-side budget management as out of scope. An agent with a funded wallet needs its own spending limits, allowlists and approval rules; x402 needs pre-payment risk gates shows what that looks like.
• Hostile instructions. An agent that reads untrusted pages can be steered toward the wrong endpoint or pay-to address. Validate the counterparty before signing, not after.
• Uncertain settlement. A facilitator can return a non-terminal settlement_pending code with a transaction hash, which the caller must reconcile on chain before deciding whether to retry. x402 specification v2 The same discipline as payment idempotency applies.
• Replay. The specification's protections include a 32-byte nonce, explicit validity windows and payer signatures.
• Compliance. Some facilitators run KYT (know your transaction) checks, and the FAQ lists a KYT-flagged address as one reason a payment fails. Rules for stablecoin payments differ by country, so check the position in each market you serve.

x402 vs card-based agent payments: what is the difference?

Card programs such as Visa Intelligent Commerce and Mastercard Agent Pay solve a different problem: letting agents use existing card credentials at existing merchants. Many agent products will need both.

FAQ

What is x402 in simple terms?

A way for a website or API to say "pay first" with HTTP status 402, and for an AI agent to pay automatically and retry the request with proof of payment.

What does HTTP 402 Payment Required mean?

It is a standard HTTP status code that RFC 9110 reserves for future use. x402 defines how a server uses it to request payment and how a client responds.

Who created x402?

Coinbase created it. It is now developed as an open standard under the x402 Foundation, with Coinbase, Cloudflare and Stripe on its Technical Steering Committee.

Does x402 only work with crypto?

Today it settles on blockchain networks, typically in stablecoins such as USDC. The project says it aims to support fiat networks, but it has no native fiat off-ramps yet.

Can you get a refund on an x402 payment?

With the exact scheme the payment is irreversible, so a refund is a new transfer from the seller. Some schemes, such as batch-settlement, define refund mechanics.