What is x402? The plain-English guide to agentic payments

The numbers at a glance

Every row carries its own source and the date it was checked. Figures are as published; where two sources count differently, both are shown rather than averaged.

How x402 works, step by step

Think of a vending machine that talks.

1. The agent asks. A program requests a page or an API endpoint, exactly like a browser would.
2. The server quotes a price. Instead of returning the content or a 403 error, the server returns HTTP 402 with a small payload that says: here is the price, here is the accepted asset, here is where to pay.
3. The agent pays. It signs an authorisation to transfer that exact amount, usually in USDC.
4. A facilitator checks the payment. This is a service that verifies the signed payload and submits the settlement to a blockchain.
5. The server delivers. The request is retried with proof of payment attached, the server confirms, and the content comes back.

The whole exchange happens inside normal web traffic. There is no signup screen, no invoice, no subscription. On the seller's side, adding it is close to one line of middleware:

app.use(paymentMiddleware({
  "GET /weather": {
    accepts: [...],            // the networks and assets you accept
    description: "Weather data"
  }
}));

The five parts of the system

The client (usually an agent). Any software that can make an HTTP request and hold a wallet.

The resource server. Your site, your API, your data feed, your MCP tool.

The facilitator. The middleman that verifies and settles payments so you do not have to run blockchain infrastructure yourself. There are roughly 18 tracked facilitators.

The chain. Base handles the large majority of settlement. Solana and Polygon are the other two chains in TRM Labs' dataset. The protocol itself is chain-agnostic and more networks keep being added.

The asset. In practice, USDC. It carried 99.6% of all value settled.

Why HTTP 402 sat unused for 29 years

When the web's specification was written, 402 was reserved for a future payment system that never arrived. Card payments needed accounts, merchant relationships, chargeback rules and a human tapping confirm. None of that fits inside a single web request, so the code stayed a placeholder.

Two things changed. Stablecoins made it possible to move a fraction of a cent instantly for almost no fee. And AI agents created a class of buyer that has no hands, no credit card and no patience for a signup form. x402 is the piece that connects those two facts.

Who is behind x402

x402 was created by Coinbase and launched in May 2025. Version 2 of the protocol shipped in December 2025.

The governance story moved fast after that. On 2 April 2026, the Linux Foundation announced the x402 Foundation at the MCP Dev Summit in New York, with Coinbase contributing the protocol. The date is a joke about the status code. On 14 July 2026, the Foundation launched operationally under formal open governance, with 40 member organisations, 17 of them premier members.

The premier membership list is most of the payments industry: Visa, Mastercard, American Express, Stripe, Adyen, Fiserv, Google, Amazon Web Services, Circle, Ripple, Shopify, Cloudflare, Coinbase, MoonPay, the Monad Foundation, and the Solana and Stellar foundations.

That matters for one specific reason. Enterprises that would never adopt a standard controlled by a single crypto exchange will consider one hosted by the Linux Foundation. Neutral governance is the price of entry for the boring, large integrations.

Timeline of the main events

What the data really shows

This is the part most coverage flattens into one headline, so it is worth walking through slowly.

The headline numbers are real but noisy

Different trackers report anywhere from 100 million to over 200 million cumulative transactions for overlapping periods, because they scope chains and facilitators differently. Coinbase counted roughly 165 million transactions and $50 million by late April 2026. Chainalysis found the protocol crossed 100 million cumulative transactions on Base alone through Q1 2026. TRM Labs counted 198.9 million settlements across three chains by September 2026.

None of these are wrong. They are measuring different things. Always check the chain scope and the facilitator scope before comparing two x402 numbers.

A lot of that volume was not commerce

Chainalysis identified the driver of the late-2025 surge: PING, a meme coin that used x402 as a pay-to-mint mechanism. Users had to trigger a 402 response and pay to mint. That is protocol traffic, not someone buying data.

The drop afterwards was steep. BlockEden's analysis showed daily transactions falling from about 731,000 in December 2025 to about 57,000 in February 2026, a decline of roughly 92% from the peak.

Only 0.6% to 7.5% of screened commerce is plausibly AI agents

This is TRM Labs' contribution, and it is the number worth citing. From $52.7 million of settled value, TRM removed self-payments, bulk flows from one or two payers, and sellers with fewer than 10 buyers. That left $25.62 million as plausible commerce. Then it applied two models to estimate the agentic share: a loose one and a strict one. The result was 0.6% to 7.5%.

The structural problem TRM points out is more important than the percentage. Nothing in the protocol requires an AI to initiate a payment. A cron job, a load test, a self-payment loop and a human clicking a button all produce an identical on-chain record. A settled transaction proves value moved. It does not prove a model made a decision.

That gap is the same one Kunzum's own work runs into from the other direction: a number is only worth quoting if the method behind it is published and can be argued with. The Kunzum research corpus is open for exactly that reason, and it is the standard this page holds other people's figures to.

Payments of $1 or more went from 49% to 95% of volume

x402 is sold as a micropayment rail, but the dollar mix moved the other way. Payments of $1 or more went from 49% of volume in early 2025 to 95% by early 2026. Sub-dollar activity is shrinking as a share of dollars moved, even while raw transaction counts stay high.

There is a genuinely encouraging signal underneath all this. Chainalysis reported a roughly four-fold improvement in tester-to-payer conversion over the six months to June 2026. People who try it are increasingly becoming people who use it.

x402 is not the only agentic payment standard

This is the most common point of confusion. These protocols are mostly layers, not rivals.

A single real transaction might use AP2 for the authorisation proof, ACP for the checkout handshake, and x402 for settlement. Google already wired x402 into AP2 as its crypto settlement extension, co-developed with Coinbase, the Ethereum Foundation and MetaMask.

Practical takeaway: do not wait for a winner. The groundwork that pays off regardless of which acronym wins is the same in every case. Structured, machine-readable product and service data. A checkout or endpoint an agent can reach without a browser. Hard spending controls on any agent that can spend.

What x402 means if you publish content

This is where the story stops being about crypto and starts being about every website.

Anthropic crawled nearly 71,000 pages per referral, in June 2025

The underlying problem is measurable. Cloudflare published crawl-to-referral ratios showing how many pages AI crawlers take for each visitor they send back. Over one week in June 2025, Anthropic's Claude made nearly 71,000 HTML page requests for every referral. OpenAI was at 1,600 to 1, Perplexity 202.4 to 1, Microsoft 40 to 1, Google 9.4 to 1. Traditional search crawled a few pages per visitor sent. That trade no longer holds.

Read those as 2025 figures. They are the ones Cloudflare published for the week of 19 to 26 June 2025, and they are the ones the industry still quotes, but the ratios have improved by more than an order of magnitude since. Any page citing them without the date, including this one if it is not kept current, is describing a moment rather than a state.

Cloudflare's response has three layers. AI Crawl Control lets publishers sort crawlers by intent: search, agent, or training. It reached general availability in August 2025 and was consolidated across every plan tier during Agents Week in April 2026. Pay Per Crawl lets publishers set a price for crawler access, with Cloudflare acting as merchant of record; it remains in closed beta, and on 1 July 2026 Cloudflare announced it is evolving into Pay Per Use, with experiments involving Ceramic.ai and You.com. The Monetization Gateway, announced the same day, extends the same logic to any resource behind Cloudflare using x402: APIs, data feeds, MCP tool calls, not just pages.

Cloudflare sits in front of 25.8% of the web

Two numbers show the scale. Cloudflare sits in front of 25.8% of the websites W3Techs surveys as of September 2026, roughly one in four. And sites on its network are already sending over a billion HTTP 402 responses to AI crawlers every day.

From 15 September 2026, Cloudflare's defaults block mixed-use crawlers, ones that blend search, agent and training use, from any page carrying ads. That applies to new customers, new sites from existing customers, and all existing free-tier customers.

So the pricing infrastructure is being installed at internet scale while proven agent spend is still tiny. Both things are true at once. If you publish anything an AI agent might want, the question is shifting from should I block them to what is my price.

Answering that second question needs a measurement you almost certainly do not have yet: which engines are retrieving your pages, and what they do with them. That is the work Kunzum sells, for crypto and fintech companies specifically.

What people actually pay for with x402 today

The live use cases cluster into a few categories.

Data and signals. Pay-as-you-go access to scraping, news feeds and real-time analytics.

Inference and model routing. Agents paying per call to inference marketplaces and routers. These carry the highest per-call volume.

Content access. Per-page or per-article unlocking, including independent implementations that charge agents a cent per page and issue a public receipt for every crawl.

Storage, compute and delivery. Pay-as-you-go patterns with active pilots.

Agent-to-agent commerce. One agent paying another for a skill or a task, compatible with MCP-style workflows.

Adoption is workload-driven rather than user-driven. A single research-agent campaign can move daily volume by a third or more, which is why the cumulative trend is more meaningful than any single day.

Risks and open questions

A fair hub says what could go wrong.

Attribution is unsolved. There is no reliable way, from on-chain data alone, to prove an AI agent rather than a script made a payment. Every agent economy statistic inherits that weakness.

Volume can be manufactured. The PING episode showed how easily a token incentive can inflate transaction counts by an order of magnitude and then collapse.

Security research is early. Academic work has already catalogued attacks against the protocol. Treat any production deployment as new infrastructure, not settled infrastructure.

Standards may consolidate. x402 currently has the most production traction at the settlement layer, but AP2, ACP, MPP and UCP are all being pushed by companies with enormous distribution.

The ticker confuses everything. There is a token that shares the protocol's name. Protocol adoption and token price are different subjects, and most search traffic conflates them.

How to start, in practice

If you want to sell to agents: add payment middleware to one endpoint, pick a facilitator, price it in USDC, and settle on Base. If your site already sits behind Cloudflare or AWS CloudFront, metering is closer to a configuration change than a rewrite. Start with one endpoint and one price, and watch who pays.

If you want your agent to buy: give it a wallet with a hard spending limit, use a facilitator rather than settling yourself, and log every receipt. Bounded budgets and an auditable trail are the discipline the whole protocol stack is built around.

If you publish content: before pricing anything, find out which AI crawlers are already taking your pages and what they send back. You cannot set a price on access you have not measured.

FAQ

Update log

This page is maintained. Every change to a figure or a date is recorded here, so a reader who cited it six months ago can see what moved.

• 18 September 2026Initial publication. Added the TRM Labs September measurement, the Cloudflare mixed-use crawler deadline, and the full standards comparison.