x402 Explained: How HTTP 402 Payments Work for AI Agents

x402 is an open protocol that uses the HTTP 402 Payment Required status code so a server can ask for payment before it returns a resource, and a client can pay within the same HTTP exchange. Coinbase created the protocol and launched it in May 2025. In April 2026 the Linux Foundation announced the x402 Foundation to steward it as a neutral, open-governance project. The promise is that APIs, websites and AI agents can settle small payments per request without accounts, subscriptions or API keys. The protocol settles payments; it does not decide whether an agent should spend money, so access control and facilitator trust remain engineering decisions.

Why HTTP 402 needed a standard

RFC 9110 defines the 402 status code only as reserved for future use, so HTTP itself never specified how a payment request should look (RFC 9110, section 15.5.3). Cloudflare says sites on its network send more than a billion 402 responses a day to bots and crawlers, and that these responses too often go unheard because there is no standard way to describe the payment (Cloudflare). x402 supplies that format.

How the x402 payment flow works

A client requests a resource that the server gates with x402.
The server responds with 402 Payment Required and machine-readable instructions that include the amount and recipient.
The client repeats the request with a payment authorization.
A facilitator verifies the payment payload and settles the transaction.
The server returns the resource with a payment response that confirms the outcome.

This is the flow Cloudflare describes in its primer on the protocol (Cloudflare). In x402 V2, payment data moved into HTTP headers named PAYMENT-REQUIRED, PAYMENT-SIGNATURE and PAYMENT-RESPONSE, replacing deprecated X-prefixed headers. Networks are identified with CAIP identifiers, such as eip155:8453 for Base (x402 V2 announcement; CDP facilitator documentation).

Payment schemes: exact, upto and batch settlement

The scheme determines how a price is expressed and settled. Coinbase's hosted facilitator documents the three schemes below.

Scheme	What it does	Support in the CDP facilitator
exact	Transfers a fixed amount for one request	EVM networks and Solana
upto	Authorizes a maximum amount and settles the amount actually used	EVM networks and Solana
batch-settlement	Verifies vouchers off-chain and claims them together on-chain	EVM networks only

SignorCrypto analysis: the scheme should follow the pricing model, while network support changes over time. CDP says its supported schemes and networks endpoint is the programmatic source of truth, so teams should query it rather than hard-code a list (CDP facilitator documentation).

What the x402 Foundation changes

The Linux Foundation says the x402 Foundation will be the neutral home for the protocol, which Coinbase contributed and which was initially developed by Coinbase, Cloudflare and Stripe (Linux Foundation, 2 April 2026). The announcement lists companies that expressed initial intent and support, including Adyen, Amazon Web Services, American Express, Circle, Google, Mastercard, Microsoft, Shopify, the Solana Foundation, Stripe and Visa.

SignorCrypto analysis: open governance reduces the risk that one vendor controls the specification. It does not, by itself, certify any facilitator, network or token, and a list of supporters signals intent rather than production-grade security.

Open questions for builders

The deferred scheme is still a proposal

Cloudflare has proposed a deferred scheme for agentic payments that do not need immediate settlement, such as pre-negotiated licences, batch settlement or subscriptions. In that design the client sends a signed payment commitment using HTTP Message Signatures, and the server settles later. Cloudflare says no blockchain is involved in that flow, and it presented the scheme as a proposal for a future major version, so developers should not assume it is in production (Cloudflare).

A paid request is not an authorization policy

A successful 402 flow shows that a specific payment was authorized for a specific request. It does not decide whether the agent should have spent that money. SignorCrypto analysis: production deployments need per-agent spending caps, allowlisted endpoints, human approval above a threshold and audit logs that connect each payment to an agent identity and a business purpose.

Facilitators and volume figures need context

Facilitators verify payments and submit settlement. The x402 FAQ states that the protocol is permissionless and that anyone can run a facilitator (x402 FAQ). Coinbase's hosted CDP Facilitator says it validates signed payments, screens transactions, submits settlement on-chain and reports the result to the resource server (CDP documentation). Volume figures come from parties promoting the protocol: the x402 V2 announcement says it had processed over 100 million payments since May 2025, and CDP cites more than 100 million transactions and $28 million in payment volume across Base and Solana. We did not find an independent audit of these figures in the sources reviewed.

Developer checklist

Test on a testnet such as Base Sepolia (eip155:84532) before moving the same configuration to mainnet.
Match the scheme to the pricing model: exact for fixed fees, upto for capped usage, and batch-settlement for high-frequency EVM payments.
Store the payment response and settlement reference beside each request ID for reconciliation.
Confirm which screening, refund and failure-handling rules your facilitator applies.
Enforce spending limits in the agent runtime, not only in the prompt.
Document the payment policy for finance and compliance teams before launch.

Frequently asked questions

Is x402 a cryptocurrency?

No. x402 is a payment protocol for HTTP, not a token. Current examples settle in stablecoins or other tokens on blockchains such as Base and Solana. The V2 announcement also says facilitators for ACH, SEPA or card networks can fit the same payment model.

Does x402 remove the need for API keys?

Cloudflare describes x402 transactions as possible without accounts, subscriptions or API keys. The V2 announcement also describes wallet-based sessions that let a client skip repeated payment for a resource it has already bought. The Sign-In-With-X header was described as a fast-follow item, so verify its current status before relying on it (x402 V2 announcement).

Sources

Next step

If your organization is evaluating an agent-payment integration, such as a paid API, a checkout path for autonomous agents or a payment-verification service, SignorCrypto can review the architecture, security controls and implementation plan.