What Is x402? The HTTP 402 Payment Protocol for AI Agents, Explained (2026)

For 28 years, one line in the HTTP specification did nothing. Status code 402, Payment Required, was defined in January 1997 with a single sentence: "This code is reserved for future use." The web grew up on advertising instead.

In 2025 the future arrived. AI agents started reading the web for people, and a page that an agent reads earns no ad view. A protocol called x402 gave that old status code a job: a server can now reply to any request with a price, and software can pay it in the same exchange. This guide explains how x402 works, how Cloudflare pay per crawl relates to it, who gets paid, and what a site owner or builder can do about it today.

TL;DR: x402 is an open protocol that lets AI agents pay for a web page, API call or tool inside a normal HTTP request, with status code 402. Coinbase announced it on May 6, 2025, and 40 organizations joined the x402 Foundation in July 2026. Real payment volume is still small.

Quick answer: what is x402? x402 is a payment protocol built on the HTTP status code 402 Payment Required. A server answers an unpaid request with 402 and a price. The client signs a payment and repeats the request. A service called a facilitator verifies and settles the payment, and the server returns the resource. No account, API key or checkout page is needed.

In this guide: What x402 is · Why 402 sat unused · Timeline · The handshake · The actors · Payment schemes · V1 vs V2 · Pay per crawl · Monetization Gateway · Wallets and identity · x402 vs ACP, AP2, MCP · Usage numbers · Who gets paid · Site owners · What people build · Limitations · FAQ

⚡ What Is x402?

x402 is an open protocol for paying over HTTP. A server that wants payment replies to a request with status code 402 and a machine-readable price. The client pays and retries. Coinbase announced x402 on May 6, 2025, and the project site calls it "an open, neutral standard for internet-native payments" (x402.org).

The idea matters because of who the customer is. A person will not approve a payment of one cent to read one page. An AI agent can, because the payment is automatic and the agent works for someone with a budget. Cloudflare put the shift in one sentence when it announced its own x402 product: "The natural unit of payment for software is the request, the token, or the outcome, not the seat or the month" (Cloudflare, July 1, 2026).

Three plain-English points clear up most confusion:

1. x402 is a protocol, not a coin. There is nothing called an x402 token to buy.
2. x402 is not a Cloudflare product. Cloudflare builds products on it, and Coinbase started it. A foundation now governs it.
3. x402 is not the same as pay per crawl. Both use status code 402. They work differently, and a later section shows how.

🕰️ Why Did HTTP 402 Sit Unused for 28 Years?

HTTP 402 sat unused because the 1990s web had no cheap way to move one cent. The authors of HTTP/1.1 reserved the code in RFC 2068 in January 1997. The current HTTP standard, RFC 9110 from June 2022, repeats the same placeholder.

RFC 2068, January 1997            RFC 9110, June 2022
----------------------            -------------------
10.4.3 402 Payment Required       15.5.3. 402 Payment Required

   This code is reserved for         The 402 (Payment Required)
   future use.                       status code is reserved for
                                     future use.

401 Unauthorized   "Who are you?"        widely used
402 Payment Required  "Pay first."       reserved, 1997 to 2025
403 Forbidden      "You may not."        widely used
404 Not Found      "No such thing."      widely used

Companies did try to build digital cash for the early web. DigiCash, founded by David Chaum in 1989, declared bankruptcy in 1998. CyberCash, founded in August 1994, offered a micropayment system called CyberCoin. None of them became part of the browser. MDN's reference page for 402 still describes the code as reserved for future use.

The last row is the one that broke the old bargain. A search crawler read a page, sent a human visitor, and the site sold that visitor's attention. An agent reads the same page, gives its user the answer, and nobody visits. The content created value and the site earned nothing.

Cloudflare made the same argument on July 1, 2025, in a post titled Content Independence Day, and shipped pay per crawl the same day. The introduction of that feature says it plainly: the goal was to "dust off a mostly forgotten piece of the web" (Cloudflare, July 1, 2025).

📅 x402 Timeline: Key Dates From 1997 to 2026

x402 went from a whitepaper to a 40-member foundation in 14 months, from May 2025 to July 2026. The table lists each dated event with its source. Every date below comes from the linked primary page or, where marked, from press coverage.

The membership list is the detail that changed how the industry reads x402. The foundation's 17 premier members include Adyen, AWS, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Shopify, Stripe and Visa. A protocol that began as a crypto project now counts the card networks and the largest payment processors among its premier members. Our history of Shopify covers the commerce side of that story.

🤝 How Does the x402 Handshake Work?

An x402 payment is two HTTP requests: one that fails with a price, and one that succeeds with proof of payment. The x402 V2 documentation defines three headers for the exchange: PAYMENT-REQUIRED, PAYMENT-SIGNATURE and PAYMENT-RESPONSE. Each one carries a Base64-encoded JSON object (x402 docs).

That sequence follows the nine steps in Coinbase's x402 documentation. Two details are easy to miss. First, in this default flow the server does the work between verification and settlement, so a failed job does not have to be charged. The V2 specification allows a scheme to settle before the work, so check the scheme before you rely on that order. Second, the client never talks to the facilitator. The server does.

Here is what the exchange looks like on the wire. The header values are shortened, and the decoded payload is a simplified illustration. The x402 specification on GitHub holds the exact schema.

REQUEST 1  (no payment)
-----------------------
GET /api/market-report HTTP/1.1
Host: data.example.com
User-Agent: research-agent/1.0

RESPONSE 1
----------
HTTP/1.1 402 Payment Required
PAYMENT-REQUIRED: eyJ4NDAyVmVyc2lvbiI6Miwi...   (Base64 JSON)

   decoded, simplified:
   {
     "x402Version": 2,
     "accepts": [{
       "scheme":  "exact",
       "network": "<chain id>",
       "asset":   "<stablecoin contract>",
       "amount":  "<price in the asset's smallest unit>",
       "payTo":   "<seller wallet address>"
     }]
   }

REQUEST 2  (same request, now with proof)
-----------------------------------------
GET /api/market-report HTTP/1.1
Host: data.example.com
User-Agent: research-agent/1.0
PAYMENT-SIGNATURE: eyJzY2hlbWUiOiJleGFjdCIs...  (Base64 JSON, signed)

RESPONSE 2
----------
HTTP/1.1 200 OK
PAYMENT-RESPONSE: eyJzdWNjZXNzIjp0cnVlLCJ0...   (Base64 JSON receipt)
Content-Type: application/json

{ "report": "..." }

A single request moves through a small set of states. The diagram shows only the forward path. If verification fails, the server answers with 402 again and the client can try once more.

The whole exchange happens without a signup form. x402.org contrasts it with the usual path to a paid API: create an account, add a payment method, buy credits, manage an API key, then make the call. With x402 the payment is the credential. That is why Cloudflare describes the result as "No signup, no API key, no prior relationship required" (Cloudflare). For background on how requests, gateways and caches fit together, see system design explained.

🧱 Who Are the Actors in an x402 Payment?

An x402 payment has three roles: a client that pays, a resource server that sells, and a facilitator that verifies and settles. The facilitator is the part that makes the protocol practical, because it lets a seller accept payments without running blockchain infrastructure.

Two facts about facilitators deserve attention. Settlement in x402 is peer to peer: the money goes to the seller's wallet, and the facilitator does not hold it (Cloudflare). And the facilitator is a service a seller chooses, not a single company. The agenteconomy.to tracker counted 18 facilitators across 12 chains on November 12, 2026.

On networks and currencies, the Coinbase documentation says x402 runs on EVM networks and Solana, and that USDC is the most common asset, though a seller can accept other tokens (Coinbase docs). Cloudflare's wording is the most useful summary: "x402 is rail agnostic, but it is a natural fit for stablecoins."

🧮 Which Payment Schemes Does x402 Support?

x402 supports more than a fixed price per request. The V2 documentation names three settlement schemes: exact, upto and batch-settlement (x402 docs). Coinbase describes the same three in plain words: a fixed price, a maximum that settles only what was used, and settlement deferred for a batch. The V2 specification lists a fourth, auth-capture.

The deferred idea comes from Cloudflare's September 2025 x402 post, which describes a scheme "specifically designed for agentic payments that don't need immediate settlement." It separates the cryptographic handshake from the money movement, so two companies can agree on terms once and settle later in a batch or through a subscription.

Those schemes let a seller express real pricing models. Cloudflare's Monetization Gateway announcement gives examples of the rules a seller can write:

Outcome pricing is the interesting row. A server that charges only when the work succeeds matches how teams already judge AI by cost per task instead of cost per token. The same logic runs through AI inference: the unit that matters is the finished job.

🆚 x402 V1 vs V2: What Changed?

x402 V2 moved payment data out of the response body and into three standard headers. The x402 team launched V2 in December 2025 after about six months of production use, and reported that the protocol had processed "over 100M payments" by then (x402.org).

The V2 post also describes a wallet sign-in feature, which lets a client prove it controls a wallet and reach a resource it already bought without paying again. The post lists that feature as a fast follow, not as part of the first V2 release. According to the same post, the reference SDKs stay "fully backward-compatible with V1."

Because the price now travels in a header, a server can return a normal web page in the body of the 402 response. A person who lands on the URL sees an explanation. An agent reads the header and pays.

🕷️ What Is Cloudflare Pay Per Crawl?

Pay per crawl is a Cloudflare feature that lets a site charge AI crawlers for each page they fetch. Cloudflare announced it on July 1, 2025 as a private beta. Cloudflare's documentation, updated on July 28, 2026, still describes it as a closed beta.

Pay per crawl uses status code 402, but it is not x402. It has its own headers and its own money flow. Cloudflare is the merchant of record: it charges the crawler's account and pays the publisher.

The USD 0.01 value above is the example Cloudflare uses in its documentation, not a recommended price.

A crawler can avoid the first failed request. If it sends crawler-max-price with its first request and the page costs that much or less, it receives the page at once and pays only the configured price.

A site owner chooses one of three settings for each crawler. The setting applies only after the site's firewall and bot rules run.

Identity is the hard part of charging a crawler, because a user-agent string is easy to fake. Pay per crawl relies on Web Bot Auth: the crawler signs each request with a private key, and Cloudflare checks the signature against a public key the crawler operator has registered. Our guide to AI web scraping covers the other side of that relationship, the tools that fetch pages.

Pay per crawl lives inside a larger product called AI Crawl Control, formerly AI Audit. Its monitoring and allow or block controls are available on all Cloudflare plans. Only the pricing part is in beta.

🚪 What Is the Cloudflare Monetization Gateway?

The Monetization Gateway is Cloudflare's x402 product: it lets a site owner charge AI agents for any resource behind Cloudflare. Cloudflare announced it on July 1, 2026 with a waitlist and opened a closed beta on September 30, 2026. The beta is limited to eligible sellers and buyers in the United States, and payments settle in USDC on the Base network through Coinbase's x402 facilitator.

Where pay per crawl prices a page for a crawler, the gateway prices a request for an agent. The announcement lists four kinds of resource: web pages, datasets, APIs and MCP tools. The seller writes payment rules, and Cloudflare checks payment at its edge before the request reaches the seller's server.

The value for a seller is that payment logic leaves the application. In Cloudflare's words, "the metering, the payment exchange, and the settlement move off your origin." A team that already runs an API does not have to write billing code to sell it to agents. The July 2026 announcement also describes a planned rule that turns a 401 Unauthorized response from the origin into a 402, so known customers keep using their accounts and unknown agents get a price. The beta documentation does not list that rule yet.

The beta post names four live uses. They show what "a resource an agent will pay for" looks like in practice.

API2PDF's reason for joining is the clearest business case in the post. The company reported that requiring a credit card after the first month caused a drop of more than 50% in conversion. A price in the response removes that step for a customer who is software. The inference example connects to a wider trend we cover in inference as a service: compute sold by the request.

Pay per crawl vs Monetization Gateway vs Pay Per Use

Cloudflare now has three ways to charge AI systems, and each one prices a different event. Pay per crawl charges for access. The Monetization Gateway charges per request. Pay Per Use, in beta since September 30, 2026, charges for what an AI company does with content after it has it.

👛 How Do AI Agents Hold Money and Prove Who They Are?

An agent pays with a wallet a person funds and limits, and it proves its identity with a signed request. Payment and identity are two separate layers. A payment proves that someone paid. It does not prove who.

On the payment side, Cloudflare Wallets, announced on August 4, 2026, shows the shape most vendors are building toward. A person or company holds an Account Wallet and can add or withdraw funds. Each agent gets a Virtual Wallet, reached through an API key, with a ceiling the owner sets.

Cloudflare's post lists three example guardrails: a spending budget, an allow list and a cap on the size of each payment. Going over a limit needs a person to approve. On the announcement date, the only live part was claiming a handle. Funding and payments were listed as coming later, so treat this as a design, not a finished product.

On the identity side, three efforts use the same building block, signed HTTP messages:

The guardrails matter more than the payment rail. An agent that runs for hours, such as the always-on agents and AI claws we have written about, can make thousands of requests without a person watching. The same care that goes into an agent sandbox or an agent harness applies to a budget: decide the limit before the agent starts.

⚔️ x402 vs ACP vs AP2 vs MCP vs L402 vs API Keys

x402 is one of several agent payment standards, and most of them do different jobs. x402 moves a small payment inside a request. Other standards handle a shopping checkout, prove that a person authorized a purchase, or connect an agent to tools with no payment at all.

A second table answers the question a builder asks: when would I use each one?

These standards stack more than they compete. Google worked with Coinbase on an x402 extension for agent-to-agent payments when it announced AP2. Visa said it is aligning its Trusted Agent Protocol with x402. Cloudflare added x402 to MCP in its Agents SDK. The picture is a set of layers.

For the connection layer, our guides to MCP and the wiki entry on MCP vs API explain how agents reach tools. For the commerce layer, see the wiki entry on agentic commerce and our history of Shopify, which covers the Universal Commerce Protocol that Shopify and Google launched in January 2026. L402, the Lightning-based design, is documented by Lightning Labs, and the Agentic Commerce Protocol has its own site at agenticcommerce.dev.

📊 How Much Money Moves Over x402 Today?

x402 has processed a large number of transactions and a small amount of money. The public tracker agenteconomy.to showed 199,419,047 lifetime transactions and $42,833,895 settled across 12 chains on November 12, 2026. That works out to about 21 cents per transaction.

The lifetime count hides the trend. A Fireblocks analysis reported by Blockchain.News on November 3, 2026 found that more than half of all lifetime transactions came from a two-month burst in late 2025, tied to a token that was minted through x402. That activity was not agents buying services.

Read those numbers with two cautions. The tracker itself says its totals are "visible protocol activity" and can include tests, infrastructure traffic and self-directed use. And different trackers report different dollar values for the same month, because they filter that activity in different ways.

The fair summary: the plumbing is real, the membership is serious, and the commerce is early. October 2026 moved $274,000 across the whole protocol, which is a small sum for a system with 40 member organizations behind it. Anyone who tells you agent payments are already a large market is ahead of the data.

🏗️ Who Gets Paid in the Agent Internet?

Money in the agent internet flows to whoever owns a resource an agent cannot do its job without. A useful way to see it is as a stack. The model answers the question, but the model needs inputs, and each input can sit behind a price.

The model layer already works this way. Every answer is billed by the token, and the physical cost behind each token is the subject of our guide to AI data centers. x402 extends that meter outward, from the model to everything the model reads and calls.

Two things follow. First, a general web page is the weakest position in the stack, because an agent can often find the same fact elsewhere for free. Second, the strongest position belongs to data that is valuable, changes often and is hard to collect. That observation leads straight to what builders are doing with x402.

🌐 What Should Site Owners Do About AI Agents?

Most site owners should make their site easy for agents to read before they think about charging. The decisions form a ladder. Each rung is useful alone, and pricing is the top rung, not the first.

The reason to climb in order is simple. A price on a page that agents cannot parse earns nothing. And for most businesses, the goal of a website is to win customers. If an AI assistant reads your pricing page and recommends you, that is worth far more than a fraction of a cent per fetch.

When does a price make sense? Use this test:

• Charge when the content is the product: news, research, market data, a licensed archive.
• Stay free when the content sells something else: product pages, documentation, comparison guides, help articles.
• Split when you have both: keep the marketing site open and put the dataset or the API behind a price.

We follow the free path on taskade.com, and we use the lower rungs ourselves. The site publishes an llms.txt file, serves a Markdown copy of each documentation, help and blog article, and has Markdown for Agents turned on. A hosted MCP server, described in the Taskade MCP documentation and included in every paid plan, gives agents a direct way to work with a workspace. None of the reading surfaces has a price, because we want agents to understand the product.

Cloudflare's AI Index, in private beta since September 26, 2025, packages rungs 3 to 5 for sites on its network: it builds an MCP server, llms.txt files, a search API, a bulk data API and change notifications for a domain. It is a sign that these rungs are becoming standard parts of a website.

💡 What Are People Building on Top of x402?

Builders are packaging clean, structured resources that agents need, and adding a price later. The clearest public list comes from investor and podcast host Greg Isenberg, who described three business shapes in an August 2026 episode. His one-line model in the episode: "The human web monetized attention, and the agent web monetizes useful resources." The sellers that are live today are in the Monetization Gateway section above: a web search index, a market data feed, a PDF conversion API and an AI model gateway.

These are his ideas and his price estimates, not forecasts from us. They are useful because they show what a resource worth paying for looks like.

His filter for the first idea is the most reusable part. Data is worth refining when it is valuable, needed again and again, changing, fragmented across many sources, and annoying to collect. The last word is the margin.

All three ideas share a path, and x402 is the final step, not the first.

That order is sound advice whatever happens to agent payments. Each business works as a service for human customers now. If agents become real buyers, the same data gets a second kind of customer. For more on small teams building this way, see one-person companies and AI agents for solopreneurs.

Where does a workspace fit?

Each of those three businesses is a store of structured data, an agent that reads it, and an automation that keeps it fresh. That is the same shape as a workspace app. In Taskade Genesis, a project holds the records, an AI agent works on them, and an automation runs on a schedule and writes the results back.

To be exact about what exists today: Taskade does not support x402 payments or agent wallets. An automation can call an external API with the HTTP Request step and reach MCP tools with the MCP Client connector, and both run on every plan, Free included. Access to outside services still uses the keys and accounts you provide. What a workspace gives you now is the first three steps of the path above: the data, the agent and the refresh loop. You can browse working examples in the Taskade App Factory or start from the AI app builder.

🚧 What Are the Limitations and Open Questions?

x402 works as a protocol, and it still has open problems in volume, access, identity and trust. An honest explainer should list them.

Three points deserve a longer note.

Security is an active research area. Sessions and wallet sign-in reduce repeated payments, and they also create tokens that can leak. Any team that accepts x402 should log each payment's scheme, amount, network and settlement status, keep the raw PAYMENT-* header values out of its logs because PAYMENT-SIGNATURE carries a signed payment authorization, and treat a paid endpoint with the same care as a login.

The buyer has to exist. A price is only useful if agents carry wallets. That is why the wallet products matter more than the gateway products, and why the 2026 numbers are small. Sellers are ready before buyers.

Pricing knowledge is hard. Nobody knows what a page is worth to an agent. Too high, and the agent goes elsewhere. Too low, and the fee does not cover the lost visit. Expect years of experiments.

The same uncertainty applies to builders. If you start a data business because of x402, make sure it earns money from people first.

📖 x402 Glossary: Terms in Plain English

For more agent vocabulary, the agentic AI glossary covers the terms around planning, memory and tools.

🔗 Related Reading

• What Are AI Agents?: the buyers in this story
• Browser Agents Explained: how agents use sites that have no API
• The History of Browserbase: infrastructure for agents that browse
• Best MCP Servers and the Taskade MCP server: the tool layer agents call
• Agentic Workspaces: where agents, data and automations live together
• 100+ integrations: the services an automation can reach today (premium integrations need a paid plan)

💬 Frequently Asked Questions About x402

🧾 Sources

All facts in this guide were checked on November 12, 2026.

• IETF, RFC 2068, section 10.4.3 (January 1997) and RFC 9110, section 15.5.3 (June 2022)
• MDN, 402 Payment Required
• x402 Foundation, x402.org, the x402 V2 launch post, the HTTP 402 documentation and the whitepaper
• Coinbase Developer Platform, how x402 works and the x402 repository
• Linux Foundation, operational launch of the x402 Foundation (July 14, 2026)
• Cloudflare, Introducing pay per crawl, Content Independence Day, Launching the x402 Foundation with Coinbase, An AI Index for all our customers, Announcing the Monetization Gateway, Monetization Gateway beta, Pay Per Use, Cloudflare Wallets, Web Bot Auth and Markdown for Agents
• Cloudflare developer documentation, AI Crawl Control, What is pay per crawl? and Monetization Gateway
• Cointelegraph, Coinbase x402 payments protocol (May 2025)
• Google Cloud, Agent Payments Protocol (AP2) (September 16, 2025)
• Stripe, Instant Checkout and the Agentic Commerce Protocol (September 29, 2025)
• Visa, Trusted Agent Protocol (October 14, 2025)
• Agent Economy, x402 tracker (read November 12, 2026)
• Blockchain.News, Agent economy data points show growth, but payment metrics remain noisy (November 3, 2026, reporting a Fireblocks analysis)
• Greg Isenberg, Cloudflare will make 1000+ AI millionaires (August 10, 2026)
• Wikipedia, DigiCash and CyberCash

Featured photo: 183A Toll Road Park Street Mainline Toll Plaza, Cedar Park, Texas, by Larry D. Moore, CC BY 4.0, via Wikimedia Commons.

The old web paid for itself with attention. The agent web will pay for itself with useful resources: clean data, working tools and pages worth reading. x402 is the plumbing for that second model, and in 2026 it is still new plumbing with very little water in it. The part you can act on now does not need a wallet. Structure what you know, keep it fresh, and make it easy for an agent to use. In a workspace that is one loop: projects remember, agents think, automations execute. ▲ ■ ● Build your first agent-ready app with Taskade Genesis →