What is x402? It is an open protocol that lets software, including AI agents, pay for a web page, API call or dataset in the same request. The server replies with HTTP status 402 “Payment Required” and a price. The agent signs a stablecoin payment, usually USDC, and sends the request again. A facilitator checks and settles the payment, and the server delivers the content. With x402 protocol fees at zero, the costs are the price itself plus network and facilitator fees.

How we checked this

We read the x402 specification repository on GitHub, the x402.org homepage and Coinbase Developer Platform (CDP) documentation on how the flow works and on facilitators. We also read both Linux Foundation press releases (the April 2, 2026 launch of the x402 Foundation and the July 14, 2026 operational launch), Cloudflare’s September 2025 x402 announcement, its July 2026 Monetization Gateway post and its Agents SDK payment docs, plus Coinbase’s February 2026 Agentic Wallets launch page. Facts checked on September 24, 2026.

Why HTTP 402, and why stablecoins

Every web request ends with a status code. Most people know 404, “Not Found.” Code 402, “Payment Required,” has been part of HTTP for a long time, but no common format ever existed for what a 402 response should contain. Cloudflare said in its September 2025 announcement that its network already sends “over a billion HTTP 402 response codes” to bots and crawlers every day, and that “these 402 responses too often go unheard” because there is no standard way to read them. x402 is that missing standard. It says what goes into the 402 reply (price, recipient, accepted ways to pay) and what the client sends back.

The protocol describes itself as “HTTP native”: payment rides on the ordinary request, so no separate checkout page, account or subscription is needed. That matters for agents. A person can fill in a card form once and save it. An agent that calls fifty data sources in an afternoon cannot sign up for fifty accounts.

Stablecoins solve the second half of the problem. A card payment for one cent costs more to process than it is worth, and card rails assume a human cardholder. A signed USDC transfer on a low-cost blockchain can carry a very small amount and settle quickly. On paper, x402 is not limited to crypto. The GitHub specification says it “aims to support all networks (both crypto & fiat) and forms of value (stablecoins, tokens, fiat).” In practice, the live facilitators we read about settle stablecoins on blockchains. Coinbase’s facilitator supports Base, Polygon, Arbitrum, World and Solana, with USDC and EURC named among the tokens.

The x402 protocol flow, step by step

Coinbase’s documentation on how x402 works breaks one paid request into nine steps. Here they are without the code:

Step Who acts What happens
1 Agent (client) Asks for a resource, such as an API endpoint or an article.
2 Seller’s server Answers 402 “Payment Required” with the price, the recipient and the accepted payment options.
3 Agent Signs a payment from its wallet and sends the same request again, with the signed payment attached.
4–5 Server and facilitator The server asks the facilitator to verify the payment, and the facilitator confirms it is valid.
6 Server Does the requested work.
7–8 Server and facilitator The server asks the facilitator to settle, and the facilitator submits the transfer to the blockchain and reports back.
9 Server Returns the resource with a confirmation of payment.

Two details are easy to miss. First, the agent signs an authorization; it does not hand over a password or a card number. The x402 specification’s “trust minimizing” principle says no payment scheme may let “the facilitator or resource server to move funds, other than in accordance with client intentions.” Second, in Coinbase’s version of the flow, settlement happens after the server does the work, not before.

The GitHub specification calls each payment method a “scheme.” The “exact” scheme moves a fixed amount. An “upto” scheme, which would charge a variable amount based on what was consumed (tokens generated, for example), is described there as theoretical. Cloudflare has proposed a deferred scheme that separates “the cryptographic handshake from the payment settlement itself,” so a crawler could be billed in batches instead of paying on every page (Cloudflare).

For a wider view of how x402 sits next to card-based agent protocols, see our Agentic payments, explained: how AI agents pay and who is behind it.

Who pays whom, and how much per call

The money moves in a straight line: from the agent’s wallet to the seller’s wallet. Cloudflare describes its setup the same way: “Settlement happens peer-to-peer, so any funds that a buyer sends to a seller are directly deposited to the seller’s wallet” (Cloudflare Monetization Gateway, July 1, 2026). The facilitator is not a middleman holding the money. Coinbase’s docs state that “the facilitator does not hold funds or act as a custodian” (CDP facilitator docs).

The seller sets the price. Cloudflare’s example rule charges “$0.01 for every GET or POST request to /api/premium/*.” Pricing can be per page, per API route or per task, and sellers can put web pages, APIs, datasets and MCP tools behind it.

On top of the price, three kinds of cost can appear:

Cost Who sets it What the sources say
Protocol fee x402 standard “Zero protocol fees” (x402.org).
Network (gas) fee The blockchain x402.org calls these “nominal.” Coinbase’s facilitator pays gas for settlement, so neither party needs to hold the chain’s native token (CDP).
Facilitator fee Each facilitator Coinbase’s: first 1,000 transactions a month free, then $0.001 per transaction (CDP).

Who absorbs the facilitator fee depends on the seller’s setup, since it is the seller’s server that calls the facilitator. At one cent per call, a $0.001 fee is 10% of the price, which is why facilitator pricing matters more for very small payments than it first appears.

What a facilitator is, and who runs them

A facilitator is a service that does the blockchain work so the seller doesn’t have to. According to Coinbase, it “verifies payment payloads submitted by clients” and “settles payments on the blockchain on behalf of servers.” The GitHub specification adds that facilitators hide details such as gas fees and connections to blockchain nodes from both client and server. A seller can also verify payments itself; the facilitator is a convenience, not a requirement of the protocol.

Coinbase runs the best-documented facilitator, the CDP Facilitator. Sellers using it can receive funds into a CDP wallet, Coinbase Business, Coinbase Prime or a self-custody wallet (CDP overview). Cloudflare’s Monetization Gateway, announced July 1, 2026, checks and enforces payment at Cloudflare’s network edge for its customers, settling in stablecoins including USDC. Coinbase’s docs point to a separate “Network Support” page that lists other facilitators and their networks.

From Coinbase project to Linux Foundation standard

Coinbase started x402. On April 2, 2026, the Linux Foundation announced it was launching the x402 Foundation and accepting the protocol as a contribution from Coinbase. Supporters named that day included Adyen, Amazon Web Services, American Express, Circle, Cloudflare, Google, Mastercard, Microsoft, Shopify, Stripe and Visa, among others.

On July 14, 2026, the Linux Foundation announced the foundation’s operational launch and said the contribution from Coinbase was complete. It listed 40 member organizations across premier, general and associate tiers. Premier members include Circle, Cloudflare, Coinbase, Google, Mastercard, Ripple, Shopify, Solana Foundation, Stellar Development Foundation, Stripe and Visa. The GitHub repository now notes that the project sits under x402 Foundation governance, with Coinbase’s copy serving as a development branch.

What this means in practice: no single company controls the specification. A foundation with card networks, payment processors and several rival blockchains as members is more likely to keep the standard open. It does not guarantee that any particular merchant will accept x402, or that every facilitator will behave well. Our agentic commerce protocol tracker follows who has shipped what.

How much is actually flowing

Volume numbers for x402 come from interested parties, change quickly and measure different things. Here is what the sources said, with dates:

Figure Source Date or period
75.41M transactions, $24.24M volume, 94.06K buyers, 22K sellers x402.org homepage “Last 30 days,” read September 24, 2026
“More than 100 million x402 payments across Base and Solana” Coinbase CDP docs Undated, read September 24, 2026
“Over 50M transactions” Coinbase Agentic Wallets launch February 11, 2026
Solana drove about 65% of x402 transaction volume in the prior year Solana Foundation, in the Linux Foundation release April 2, 2026

Dividing the x402.org 30-day volume by its transaction count gives an average of roughly 32 cents per transaction. That is our arithmetic, not a published figure, and an average can hide a few large payments among many tiny ones. The figures also count transactions, not distinct real-world customers.

How to cap what your agent can spend

This is the question that matters most if you let an agent pay for things. x402 itself does not set a spending limit. The limit has to come from the wallet or the agent software, and you have to switch it on.

Wallet-level caps. Coinbase’s Agentic Wallets, launched February 11, 2026, offer “session caps” to “set maximum amounts agents can spend per session” and transaction limits to “control individual transaction sizes.” They also include automatic screening that blocks transactions flagged as high risk.

Approval inside the agent. Cloudflare’s Agents SDK documentation provides a hook that runs when a payment is requested, so a developer can put a human approval step there. The same docs note it can be set so “the agent pays automatically.” That documentation describes no default spending cap.

Funding as a cap. The simplest limit is the balance. A wallet that holds $20 of USDC cannot lose more than $20. Keeping the agent’s wallet separate from any larger holdings, and topping it up in small amounts, works with any tool.

Test money first. Cloudflare recommends testing on the Base Sepolia test network with test USDC from Circle’s faucet before real funds are involved.

Our guide to spending limits for AI agents covers the card-based side: ChatGPT, Gemini and card controls.

What it means if your agent pays for APIs or data

If you are a person or small team using an agent that runs into x402 paywalls, the practical changes are small but real. You fund a wallet rather than signing up for accounts. Charges show up as blockchain transfers, not card line items. Because the agent signs each payment itself, the protections you know from cards, such as chargebacks, don’t carry over in the same form. A stablecoin transfer, once settled, is not reversed by a bank. If something goes wrong, you are depending on the seller’s goodwill or on the terms of whatever service you used. For disputes involving meaningful amounts, talk to a lawyer or consumer-protection advisor in your country.

If you are on the other side, selling data or content, see Accepting payments from AI agents as a small business, without code. All of our coverage sits in the Agentic payments category.

What to watch out for

Key custody. Whoever holds the private key controls the wallet. A key stored in plain text in an agent’s settings file can be copied. Coinbase’s Agentic Wallets keep keys in “secure Coinbase infrastructure, never exposed to the agent’s prompt or LLM.” Cloudflare tells developers to store keys as secrets rather than in code. If you self-manage keys, a leak can mean a total loss of the wallet’s balance.

Runaway spend. An agent stuck in a loop can pay for the same resource hundreds of times, and each payment looks legitimate to the seller. Without a session cap, a per-transaction limit or a small balance, nothing in x402 stops it.

Prices you didn’t see. The price arrives in the 402 reply and the agent decides whether to pay. If the agent is set to pay automatically, a seller can charge more than you expected and the agent may simply accept. A per-transaction limit is the direct defense.

Manipulated agents. A web page can contain text designed to steer an AI agent. An agent that holds a funded wallet is a more attractive target. See Fake AI shopping agents: how to tell a real one from a scam for a related safety angle.

Stablecoin and chain risk. USDC is designed to track the dollar, but it depends on its issuer, and blockchains can have congestion or outages. Nothing here is investment advice; treat the wallet balance as spending money, not savings.

Moving numbers. Volume and member counts change monthly. Treat the figures above as a snapshot dated September 24, 2026.

Go deeper