What is x402? HTTP 402 Payment Required for AI agents and APIs
x402 is an open protocol that lets software pay for a web resource, one request at a time, by using the HTTP 402 "Payment Required" status code. A server answers an unpaid request with 402 and a machine-readable price. The client signs a stablecoin payment, repeats the request, and receives the resource. There is no account, no subscription and no API key: the payment is the permission.
This page is the Group's plain-language reference for x402, written by the people who run a working x402 market. Where we state a number, we give its date and its source. Where the evidence is thin, we say so.
What does x402 do, in one paragraph?
A web server that wants to be paid replies to a request with status 402 instead of 200. The reply carries a header named PAYMENT-REQUIRED, a base64-encoded JSON document listing what the server will accept: the payment scheme, the blockchain network, the amount, the token, the payee address and how long the offer stands. The client picks one option it can pay, signs a limited, single-use transfer authorization, and sends the same request again with a PAYMENT-SIGNATURE header. The server (usually through a service called a facilitator) verifies the signature, settles the transfer on a blockchain, and returns the resource with a PAYMENT-RESPONSE header that holds the receipt.
The longer, step-by-step version is in How an x402 payment works, step by step. The history of the status code itself is in What does HTTP 402 Payment Required mean?
What does HTTP 402 Payment Required mean?
HTTP is the set of rules every web browser and server follows. Its status codes are three-digit answers to a request: 200 for success, 404 for "nothing here", 500 for a server fault. The 400s mean the client's request was the problem; 401 means "sign in", 403 means "you may not have this", and 402 means "Payment Required".
The code has been in the standard since the 1990s. Every revision of the HTTP specification, from RFC 2068 (January 1997) to RFC 9110 (June 2022), has described it with the same words: reserved for future use. For almost thirty years a status code that names payment had no defined way to carry one. x402 gives it a meaning.
How do AI agents pay for APIs with x402?
An AI agent is software that chooses steps and calls other services to reach a goal. Most paid APIs assume a person on the other end: sign up with an email, choose a subscription tier, enter a card number. An agent in the middle of a task cannot easily do any of that, and a person would not want to open four subscriptions to make four one-off requests.
With x402 the agent meets the price inside the HTTP response, checks it against rules its owner set (a price ceiling, a budget, an allowlist of sellers), signs, and continues. The owner decides the budget once; the agent spends within it. Nothing in the protocol requires the buyer to be an AI agent: a script, a browser extension or a person with a wallet can pay in exactly the same way. The protocol cannot tell the difference, and neither can anyone reading the blockchain afterwards.
What does an x402 payment look like on the wire?
Here is an unpaid request to a live offer, the book The x402 Economy on market.561.group:
curl --include https://market.561.group/v1/publications/the-x402-economyThe response (checked 2026-10-21) begins HTTP/2 402 and carries a payment-required header. Decoded from base64, the central part reads:
{
"x402Version": 2,
"error": "Payment required",
"resource": {
"url": "https://market.561.group/v1/publications/the-x402-economy",
"mimeType": "application/zip",
"serviceName": "the-x402-economy"
},
"accepts": [
{
"scheme": "exact",
"network": "eip155:8453",
"amount": "9000000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"payTo": "<the seller's address>",
"maxTimeoutSeconds": 300,
"extra": { "name": "USD Coin", "version": "2" }
}
]
}Reading it: scheme: "exact" means pay precisely this amount. network: "eip155:8453" is Base, a blockchain built by Coinbase, written in the CAIP-2 naming format that version 2 of the protocol uses. amount: "9000000" is in the smallest unit of USDC, which has six decimal places, so it is 9.00 USDC. asset is the USDC token contract on Base. maxTimeoutSeconds: 300 is how long the offer stands. We have replaced the payee address here; a buyer should read it from the live response and, as the quickstart explains, check it against an address learned independently.
Who runs x402, and who built it?
Coinbase, the US cryptocurrency company, released x402 in May 2025 with an open-source reference implementation under the Apache 2.0 license. Version 2 followed on 11 December 2025. The protocol was then moved toward neutral ground: in April 2026 the Linux Foundation announced it would host an x402 Foundation, which launched operationally on 14 July 2026 with 17 premier members, among them Visa, Mastercard, American Express, Stripe, Google, Amazon Web Services, Cloudflare, Shopify and Circle, and 40 members in all.
A neutral foundation governs the specification. It does not govern the infrastructure most payments pass through: Coinbase runs the dominant facilitator and the Base network, and Circle issues the USDC that almost every payment uses. The full story is in Who built x402 and who governs it.
What currency does x402 use?
In practice, dollars on a blockchain. When the analysis firm TRM Labs examined about 199 million x402 settlements made between May 2025 and mid-September 2026, 99.6% of the value was in USDC, the dollar stablecoin issued by Circle. A stablecoin is a token its issuer promises to redeem for a fixed amount of an ordinary currency, here one US dollar. USDC supports a standard called EIP-3009 (transferWithAuthorization), which lets the buyer sign a transfer that someone else submits to the blockchain. That is how the facilitator can pay the small network fee, so the buyer needs only USDC and not a second token for fees.
Is anyone actually using x402?
Yes, but the market is small, and honest sources disagree about how small because the blockchain makes payments easy to count and hard to interpret. A transfer on a blockchain does not say whether the payer was a person, a script or an agent, whether anything was delivered, or whether the payment was a purchase, a test, or an attempt to make a project look busy.
The careful, filtered figures say this (each is dated in How big is the x402 market?):
- Visa and Artemis found $135.7 million raw and $15.0 million after filtering wash trading and tests, in the protocol's first eleven months (to 21 April 2026).
- TRM Labs found $52.7 million raw and $25.6 million filtered across Base, Solana and Polygon from May 2025 to mid-September 2026, with 0.6% to 7.5% of that value plausibly paid by AI agents.
- Daily settlement volume fell about 93% from the start of 2026 to mid-August 2026, according to figures reported by CCN. Much of the late-2025 peak was token speculation and testing.
The infrastructure works. Genuine commerce is tens of millions of dollars in total, and agents are a minority of payers. The Group's own market has the same honest problem, discussed in What happens when you sell an API on x402?
Where can an AI agent buy data with x402?
Several places exist, including Coinbase's Bazaar catalog and independent directories. The Group runs one: market.561.group, where 130 offers (as of 2026-10-21) are payable in USDC on Base. Prices run from $0.001 to $15.00 per call. The offers include 69 small data-conversion operations at $0.0012 each, Belnap four-valued logic operations at $0.001 to $0.002, live Base blockchain reads, planetary-position calculations, translation, a news briefing, and seven books. See The 130-offer x402 market, explained for the families and prices.
You can discover everything without paying:
| Interface | Address | What it gives you |
|---|---|---|
| x402 discovery | /.well-known/x402 | Every payable resource, method, price and network |
| Catalog | /v1/catalog | Input contracts, examples, output schemas, recovery rules |
| llms.txt | /llms.txt | The market in a form language models read |
| Agent card | /.well-known/agent-card.json | One A2A skill per offer |
| MCP (read-only) | POST https://market.561.group/mcp | list_apis, search_apis, get_api without payment |
How is x402 different from cards, subscriptions and other agent payment protocols?
A card payment brings chargebacks, fraud protection and near-universal acceptance, and it costs a fixed fee per transaction that makes a one-cent charge impractical. An x402 payment has no account, no chargeback and no subscription; it settles in seconds for a fraction of a cent of network cost. For a ten-dollar purchase by a person, cards usually win. For a one-cent purchase by a program, stablecoins usually do.
Among the other protocols published since 2025, only a few compete directly with x402. Stripe and Tempo's Machine Payments Protocol (March 2026) and Lightning Labs' L402 (2020) also let a request carry its own payment. Google's AP2 (proof that a person authorized an agent's purchase) and the OpenAI and Stripe Agentic Commerce Protocol (checkout through an assistant) answer different questions. The comparison is in x402 versus MPP, AP2, ACP and L402.
What are the risks of x402?
x402 moves money before the seller delivers, in one exchange, and a blockchain transfer cannot be reversed by a bank. The practical protections are ordinary ones: keep each payment small, fund a wallet with only what the program may lose, and enforce spending rules (price ceiling, budget, allowlist of sellers) outside the language model, because a web page can contain text written to talk an agent into paying. Two academic studies published in May 2026 found real flaws, such as payments reusable across resources and duplicate-settlement races, at the joins between the web request, the signed permission and the blockchain. Sellers should bind each payment to its exact request and keep their payment software current. See x402 security and the legal picture.
What should I read or do next?
- To buy something right now as a program: How to buy from an x402 market as a software agent.
- To read the whole story in one book: *The x402 Economy*, $9 in USDC over HTTP 402 itself.
- To look up a term: the x402 glossary.
- To see everything Causeway Services publishes: the Causeway Services home page.
- To browse the market's offers in a human page: market.561.group/offers/ and its own explainer at market.561.group/x402/.
- To read the primary specification: the x402 version 2 specification and x402.org.
x402 facts in this article are current to 2026-10-21 for the market's own endpoints and to 2026-09-27 for the external figures, which come from the sources named in the linked articles. Nothing here is legal, tax or investment advice.