What is the x402 protocol? It is an open standard for internet-native payments that lets clients pay for external resources: the server uses the HTTP 402 “Payment Required” status code to request payment, and the client signs a payment and retries the request to obtain the resource. x402 was launched by Coinbase in 2025 and, in 2026, handed over to the x402 Foundation under the Linux Foundation for ongoing maintenance.
How Does x402 Work?
x402 has four roles: the client that pays, the server that provides the resource, the resource being paid for, and the facilitator that verifies and executes payments. Under the official specification, the client first sends an ordinary HTTP request; the server returns a 402 status code and lists the acceptable payment requirements in the PAYMENT-REQUIRED header, including network, token, amount and recipient address. The client selects one, signs it, and resends the request with the payment information in the PAYMENT-SIGNATURE header.
The server can verify the payment itself or call the facilitator’s /verify endpoint; this step only reads state and writes nothing on-chain. Once verification passes, the server provides the resource and then settles through the /settle endpoint, with the facilitator submitting the transaction to the blockchain and waiting for confirmation. Finally, the server returns 200 and includes the settlement result in the PAYMENT-RESPONSE header.
The specification calls “how funds are moved” a scheme. The “exact” scheme transfers a fixed amount, such as paying $1 to read an article; the “upto” scheme first authorizes a per-request cap, after which the seller settles within that cap based on actual usage, suiting scenarios such as charging by the number of tokens generated.
Which Chains and Tokens Does x402 Support?
x402 aims to support all networks (both crypto and fiat) and all forms of value (stablecoins, tokens and fiat). The specification identifies networks using the CAIP-2 format, for example eip155:8453 for Base mainnet. The networks listed in the reference implementation include Base, Avalanche and Solana and their testnets, and the official SDKs also cover more chains such as Aptos, Stellar and Hedera.
As for tokens, on EVM chains x402 supports ERC-20 tokens that implement EIP-3009, with USDC used as the example in the specification; on Solana it supports any SPL or Token2022 token. The tokens actually available depend on which ones the facilitator in use supports.
How Is x402 Related to AI Agents?
The x402 specification states explicitly that AI agents can use x402 to pay for resources and services autonomously. Beyond HTTP, it also defines transports over MCP (Model Context Protocol) and A2A (Agent2Agent protocol), corresponding respectively to AI agents calling tools and agents paying each other directly; the examples in the specification also include “an LLM paying to use a tool”.
When Google launched the Agent Payments Protocol (AP2) in September 2025, it also released the A2A x402 extension together with a number of organizations, bringing crypto payments to the agent-to-agent protocol. In its discussion of agentic payments, the IMF describes x402 as a standard that lets agents embed payment requests directly in HTTP requests.
What Should Businesses Consider When Adopting x402?
The first is security boundaries. x402’s design principles require that no payment scheme may allow the facilitator or server to move funds beyond the client’s intent. In the EVM “exact” scheme, the facilitator cannot modify the amount or recipient address and only broadcasts the transaction. Each authorization carries a unique 32-byte nonce and a validity time window to prevent replay.
The second is spending control. The specification lists “client-side budget management” as out of scope, meaning x402 itself does not limit how much an agent can spend in total. When businesses let AI agents pay with x402, they need to set their own transfer limits and approvals at the wallet level.
The third is refunds and settlement order. By default, the specification verifies first, then provides the resource, and settles last, so no charge is made if processing fails; however, if a settle-first-then-serve approach is used, the specification does not define a refund mechanism.
Conclusion
x402 builds payment directly into HTTP requests, letting AI crypto agents pay per use for APIs, data and tools. It ensures that the facilitator cannot alter the amount or recipient address, but it does not control total spending, which businesses must handle at the wallet level. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.
Is your business considering letting AI agents pay via x402?
Looking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.
Request a DemoLooking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.