x402 vs AP2 vs ACP: which layer does what

One purchase in five steps

A procurement analyst tells their agent: buy 500 calls against a market-data API, spend no more than $3, stop if the unit price moves. Five things must happen before the agent has data. Each belongs to a different layer.

Step 1: authorisation

The instruction has to become something the agent can act on without asking again. The Agent Payments Protocol repository holds the specification and reference material for AP2's mandate model: the user authorises a scope of action, and the agent carries that authorisation into the purchase. Google Cloud's Announcing Agent Payments Protocol (AP2) introduces AP2's Mandates as cryptographically signed credentials that specify what an agent is authorized to do.

No value moves here. The output is a signed statement of scope, and it is the only artefact in the flow that records why a payment happened.

Step 2: discovery and order

The agent finds the merchant, reads a price, forms an order. ACP sits at this layer, and it is the weakest-evidenced acronym in this post. The Agentic Commerce Protocol defines the ACP specification for agent-initiated checkout and order flows between AI agents and merchants, including payment handlers. Kunzum's verified source list covers x402's transport behaviour and AP2's authorisation layer. It contains no ACP specification, so the ACP row in the table below describes a layer rather than a claim checked against a primary document. AP2 reaches into this step as well, because a mandate has to name what is being bought.

Step 3: the 402 handshake

This is x402, and it is the most documented step of the three. The server returns HTTP 402 with a PaymentRequirements object describing what it wants. The client answers with a PaymentPayload, and a facilitator verifies and settles it. The exact scheme transfers a specific amount, and the reference implementations ship for TypeScript, Python and Go.

The protocol itself charges no fee of its own. Payers cover network fees only, and the rail is blockchain-agnostic, covering EVM chains and Solana.

Step 4: settlement

Value moves. According to TRM Labs, x402 has carried 198.9 million settlements worth $52.7 million across Base, Solana and Polygon since May 2025, with $25.62 million screening as genuine commerce and 99.6% of value settling in USDC.

Settlement is the one place in the flow where the record is public by default. It is also the one place where the record says nothing about intent.

Step 5: delivery

The resource is released. Where the seller is on Cloudflare, this is now a product step rather than a bespoke integration. The Monetization Gateway, published 1 July 2026, lets Cloudflare customers charge for any protected asset, whether a page, a dataset, an API or an MCP tool, settling in stablecoins over x402. That reaches a lot of the web: Cloudflare sits in front of 25.8% of all websites as of the September 2026 W3Techs survey.

The layer map

The acronyms compose. That answer is true and useless. What matters is which one owns which step, and only steps 2 and 3 have any real argument between them.

Which layer breaks if you skip it

Skip authorisation and the agent has spending capability with no mandate trail. The chain records a transfer, not a purpose, which is fine until a refund, a dispute, or an auditor arrives.

Skip the commerce layer and the agent cannot find a price it can act on. Every purchase becomes a bespoke integration, which is roughly where most agentic commerce sits.

Skip x402 and you are back to API keys and monthly invoices. Nothing breaks. You just cannot charge per request, and for a dataset or a single tool call that is the only unit that makes sense.

Where they overlap, and where they compete

The convention is that x402 handles transport and AP2 handles authorisation. That holds until someone puts the mandate inside the payment payload, at which point authorisation has been absorbed into the payment layer and the two are competing for the same slot.

The middle of the stack is where the standardisation fight is actually happening. The Linux Foundation's operational launch of the x402 Foundation on 14 July 2026 brought 40 member organisations, with 17 premier members including Adyen, AWS, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Monad Foundation, MoonPay, Ripple, Shopify, Solana Foundation, Stellar Development Foundation, Stripe and Visa. A facilitator role with that much backing stops being a differentiator and starts being infrastructure.

Cloudflare competes at a different joint. Pay Per Crawl makes Cloudflare the merchant of record for crawler access, which is the commerce layer wearing a CDN's clothes. Its chief strategy officer said on a CoinDesk panel in May 2026 that the network sends over a billion HTTP 402 responses a day. That is a quoted remark rather than a published statistic, and it describes demand signal, not paid volume.

What the numbers actually show

Cumulative counts and daily activity point in opposite directions. Chainalysis reports well over 100 million cumulative x402 transactions on Base through Q1 2026, and payments of $1 or more rising from 49% of value in early 2025 to 95% by early 2026. Coinbase's own count in late April 2026 was roughly 165 million transactions across about $50 million of volume and 69,000 active agents, published the week Agent.market launched.

Against that, CoinDesk citing Artemis puts real daily x402 volume at around $28,000, with an average payment near $0.20 across roughly 131,000 daily transactions. BlockEden records daily transactions falling from about 731,000 in December 2025 to about 57,000 in February 2026, a decline of over 92%.

Both sets of numbers can be true. Cumulative counters accumulate. TRM Labs screening to $25.62 million of genuine commerce, with 0.6% to 7.5% of that plausibly agentic, is the more useful denominator. On that basis, the layer question is settled in theory and barely tested in production.

What to build now

Four decisions survive whichever acronym wins.

1. Keep the mandate outside the payment rail. Store the authorisation as its own record and reference it from the payment payload. A settlement hash proves value moved. It does not prove anyone agreed to the purpose.
2. Do not hardcode a chain. x402 is blockchain-agnostic by design, and the settlement split across Base, Solana and Polygon is not stable.
3. Treat the facilitator as replaceable. With 40 organisations behind the Foundation, a single facilitator is a dependency, not an architecture.
4. Instrument the 402s you send. They are a demand signal, and most operators are not counting them.

If you want the layer vocabulary in one place, the glossary covers the terms. If you are deciding whether the corpus behind this post is worth your time, the research on where AI engines cite crypto shows the method. And if you are building on the Cloudflare side, the Monetization Gateway write-up walks through what the product does.