HTTP 402 & x402: How AI Agents Pay for Content

HTTP 402 Payment Required was reserved in early web standards for future digital payments, but no standard ever materialized. x402, an open protocol that originated at Coinbase and is now stewarded by the x402 Foundation, makes the code functional. A server answers an unpaid request with 402 and structured payment terms. The client signs a payment, resubmits the request with proof attached, and receives the content. The design targets autonomous AI agents, which cannot complete card forms, bank authorizations or OAuth flows built around a human. This brief covers the concepts, the request flow, the main use cases, a comparison with traditional payment rails, and the pitfalls implementers should plan for.

Key concepts

HTTP 402 Payment Required

A status code reserved in early web standards for future digital payments. It was never formally standardized, and x402 turns it into a working payment negotiation signal. S1 · cfotech.caS4 · digitalapplied.comS6 · eco.com

x402 protocol

An open, chain-agnostic standard, not a new coin or proprietary platform, that lets any HTTP client pay a server for a resource inside the request cycle, typically with stablecoins. S3 · medium.comS5 · allium.so

PaymentRequired payload

The structured body of the 402 response. It contains the amount due, accepted currencies, receiving address, and a nonce or expiry to prevent replay attacks. S2 · fireblocks.com

X-Payment header

The request header in which the client re-sends the original request with its encoded, signed payment proof so the server can verify and settle it. S2 · fireblocks.com

Facilitator

An onchain verification and settlement service. It checks the signature and balance and settles the payment, so resource servers need not run blockchain nodes or manage wallets. S6 · eco.com

Agentic commerce

Commerce in which AI agents plan, decide and act for users and organizations, and therefore need to pay for APIs, data feeds, compute and services themselves. S2 · fireblocks.com

The x402 request-pay-retry flow

1. Client requests a protected resourceThe agent or application sends a standard HTTP request to the resource server, which has registered the endpoint as payable and configured its accepted payment terms.
2. Server replies with HTTP 402Without valid payment, the server returns 402 and a PaymentRequired payload: amount, accepted currencies, receiving address, network, and a nonce or expiry against replay.
3. Client constructs a signed paymentThe payment client picks a wallet and asset and signs a payload. For EIP-3009 tokens like USDC this is a gasless authorization signature; other ERC-20 tokens use Permit2.
4. Client retries with payment attachedThe original request is re-issued with an X-Payment header carrying the encoded payment proof.
5. Verification, settlement and deliveryThe server forwards the payment to a facilitator, which verifies the signature, checks the balance and settles onchain. Once confirmed, the server returns the resource.

Why 402 sat unused and what changed

HTTP 402 was included in early web standards in the 1990s as a placeholder for digital commerce, yet no standard ever materialized. Credit cards, OAuth tokens and API keys filled the gap instead. One reason micropayments stalled was that traditional systems had high fees, slow settlements and no universal method. Card networks require human authentication, bank transfers require human authorization, and OAuth flows presuppose a human in the loop, so none suit software acting on its own. x402 addresses this by treating payment as a first-class primitive of the HTTP layer rather than business logic bolted on top. Settlement uses stablecoins or other digital assets, and fees can be mere fractions of a cent, which makes pay-per-use pricing economically feasible. The protocol arrived as autonomous agents spread. Google's Agent-to-Agent (A2A) protocol gave services a common language for coordinating tasks but lacked a payment mechanism, and x402 supplies one.

Roles, facilitators and developer effort

The flow involves three parties: the client (an AI agent or application), the resource server (the API or service requiring payment), and the facilitator, which handles onchain verification and settlement. Because the facilitator abstracts onchain complexity, resource servers do not need to run blockchain nodes or manage wallets. One source describes adding x402 support as comparable to adding an API key check, roughly 10 lines of middleware code, with server libraries handling payment verification. The same source says Cloudflare contributed Workers-native middleware so APIs deployed on Cloudflare can accept x402 payments with minimal configuration, while Coinbase contributed Base infrastructure and USDC payment rails. The standard is blockchain-agnostic and works with all EVM-compatible chains and Solana. It is hosted by the x402 Foundation, with backing from Cloudflare, Visa and others, and a whitepaper written by the Coinbase Developer Platform was released on May 6, 2025.

Use cases for agents and publishers

Three uses are most common. First, AI agent payments: an autonomous agent pays for APIs, inference calls and data feeds mid-task, without a human topping up credits or re-entering a card. Second, API and data monetization: providers charge per request or per unit of data, with settlement inside the same HTTP call. Third, agent-to-agent commerce: one agent pays another for a service or output. Other examples include per-query AI API billing, pay-per-article web content and autonomous procurement. In each case payment is part of the request itself, with no account, no subscription tier and no invoice arriving days later. A personal assistant calling a weather API could pay a small fee on the spot and retrieve the data in seconds. Agents can spend budgets across thousands of micro-transactions without a human authorizing each payment. x402 is also positioned alongside related standards such as Google's A2A and Agent Payments Protocol (AP2), and one source contrasts it with Stripe's proprietary Machine Payments Protocol.

Traditional payment rails vs x402

Timeline

1. 2025
   Google introduces the Agent-to-Agent (A2A) protocol, which lacks a payment mechanism.cfotech.ca
2. 2025-05
   Coinbase Developer Platform releases the x402 whitepaper on May 6.allium.so
3. 2026
   In early 2026, Coinbase and Cloudflare put HTTP 402 to work via x402.digitalapplied.com

Common pitfalls

• Include a nonce or expiry in every PaymentRequired payload; without it, a captured payment proof could be replayed against the endpoint.
• Signature scheme depends on the token: EIP-3009 tokens such as USDC use a gasless authorization, while other ERC-20 tokens need Permit2. Match the client to the asset.
• Deliver the resource only after verification and settlement are confirmed. The facilitator checks the signature and the client's balance before the server responds with content.
• Agents can spend across thousands of micro-transactions without per-payment human approval, so budget limits must be set in the agent or wallet layer.

Key takeaways

• x402 makes payment part of the HTTP exchange: 402 with terms, signed payment, retry with proof, then content.
• A facilitator handles onchain verification and settlement, so servers need no nodes or wallets; reported server effort is roughly 10 lines of middleware.
• It is open and chain-agnostic, working with EVM-compatible chains and Solana, with USDC the stablecoin most often cited.

FAQ

How this page is made. Built from the full text of 6 sources found with the AISA Tavily API (advanced search), refreshed weekly. A language model organizes what those sources state into the blocks above; each block links the sources it draws on, and figures that do not appear in the sources are removed.