What is x402?

x402 is an open source protocol (Apache 2.0 license) that attaches a payment directly to an HTTP request, reviving the 402 "Payment Required" status code, reserved by the web's original architects in 1991 and never actually implemented in thirty-five years. An AI agent calls a paid endpoint, receives a 402 response with the payment details required, settles the amount (typically in stablecoins) and gets the resource in the same request sequence, with no account creation, no API key purchased in advance and no card entry. Born in 2025 out of Coinbase's Developer Platform together with Cloudflare, the protocol moved to vendor-neutral governance: the Linux Foundation declared the x402 Foundation operationally launched on July 14, 2026, with about forty founding organizations including Visa, Mastercard, American Express, Stripe, Google, AWS, Shopify, Ripple, Circle and Coinbase itself. The reference repository remains github.com/coinbase/x402, now a development fork of the official base transferred to x402-foundation.

See also: Agentic commerce · A commercial transaction an AI agent executes for a user: discovery, authorization, payment and proof of mandate.

How it works in practice: Cloudflare's wallets

On August 4, 2026 Cloudflare announced Cloudflare Wallets, an implementation that makes the protocol tangible. The system distinguishes two wallet types: an Account Wallet belongs to a person or a company with a Cloudflare account and is what actually holds the funds; a Virtual Wallet belongs to an AI agent authorized to spend within limits set by its human owner, carrying a readable identifier in the form something.cloudflare.pay. The owner sets the spending cap, the list of approved merchants and the threshold above which explicit human authorization is required; the agent then makes every single call to a paid API without stopping to ask permission each time, within that perimeter. It is the concrete example of what "headless agentic commerce" means: a service behind an HTTP endpoint that pays for itself, call by call, with no checkout interface at all.

The clear difference from agentic commerce

x402 is not a synonym for agentic commerce: the two are different territory, solving different problems. Agentic commerce, and mandate protocols such as AP2, Mastercard Agent Pay or Visa's Trusted Agent Protocol, cover an agent buying something on behalf of a human end user, through a traditional checkout with cryptographic proof that this specific purchase was authorized by that human. x402 covers a payment native to HTTP itself, between machines: an agent paying an API or another system to obtain a service, typically a micropayment, with no checkout and no mandate signed transaction-by-transaction, because the spending limit was already set upstream, on the wallet itself.

Why it matters for decision makers

x402 introduces a new operational risk vector for anyone adopting autonomous AI agents with spending capability: the question to ask before adoption is not whether the protocol will win, but who decides the spending cap on each Virtual Wallet, how every autonomous payment gets audited, and what happens if a compromised agent starts draining the wallet call after call. Separating fund custody (Account Wallet) from spending capability (Virtual Wallet) is the first line of defense, but it remains a control that procurement and security teams need to know how to configure and monitor, not a setting to leave at the provider's default.