How does an x402 payment actually work?
The 402 Payment Required status code has been in the HTTP specification since the 1990s, reserved for future use and left unimplemented. x402 gives it a defined handshake and a header format, so a payment becomes something a server can demand mid-request rather than something arranged beforehand through an account.
The exchange runs in four steps. A client requests a resource. The server answers 402 with a payment-requirements object describing what it wants, including the price, the network and the payment scheme. The client picks one of the offered requirements, builds a signed payment payload, and sends the request again with that payload in a header. The resource server verifies the payload, either itself or by posting it to a facilitator, and settles before serving the resource (the x402 documentation, QuickNode).
Absent from that sequence is the apparatus a normal payment needs: no account to create, no API key to provision, no subscription, no card stored anywhere. A buyer that exists for four seconds cannot sign up for anything, and that constraint is what the protocol was drawn around.
Who governs x402 now?
Coinbase authored the protocol and open-sourced it in May 2025 (the coinbase/x402 repository), and no longer controls it. The Linux Foundation declared the x402 Foundation operational on 14 July 2026, with Coinbase completing its contribution of the protocol into neutral stewardship and 40 member organisations signed on (Linux Foundation, Open Source For You).
The premier members are Adyen, Amazon Web Services, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Monad Foundation, MoonPay, Ripple, Shopify, Solana Foundation, Stellar Development Foundation, Stripe and Visa. Several of those companies operate the card rails that an HTTP-native stablecoin payment routes straight past. They joined the body that stewards it anyway.
How much money actually moves over x402?
Less than the headline numbers suggest. Visa and Artemis put the protocol at roughly 15.0 million dollars in adjusted volume across 109.6 million transactions since launch, on data cut at 21 April 2026, concentrated on Base, Solana and Polygon (Visa, Cointelegraph).
Adjusted is doing real work in that sentence. It means identified wash and test activity has been stripped out, and Visa states plainly that the raw on-chain totals are higher. The average payment is a fraction of a cent, which is what a micropayment rail should look like and also what makes transaction counts easy to inflate.
I have had two published x402 figures in front of me that could not have been describing the same object. Before an x402 number goes into a board deck, establish three things about it: whether it is raw or adjusted, what date the data was cut, and what the source is counting as one transaction.
What can you pay for with x402 today?
Amazon Bedrock AgentCore payments became generally available on 18 August 2026, built with Coinbase and Stripe, letting an agent settle in USDC without a human approving each transaction (AWS, The Paypers).
Two details sit below the headline. At preview the service spoke x402 and nothing else; at general availability it added the Machine Payment Protocol, so a cloud provider that had picked a winner stopped picking one. AWS also added support for the upto scheme within x402, which lets an agent commit to a ceiling instead of an exact price. Pay-per-inference needs that, because a model call's cost is not knowable at the moment the request is made.
Is x402 the same thing as ACP or AP2?
No, and the three are frequently discussed as if they were rivals. They are layers of one purchase. The Agentic Commerce Protocol standardises the merchant checkout. The Agent Payments Protocol standardises the authorisation, the signed record proving a person allowed the spend and inside what limits (the difference between ACP and AP2). x402 sits underneath both as transport: the mechanics of attaching money to a request.
Choosing a transport is the easy half. x402 was never scoped to record consent, and a team that has wired it up has solved how the money travels without yet touching who agreed to send it.