x402 revives a forgotten HTTP status code to let software pay for services in real time, no keys required. x402 is an open payment protocol that lets clients request paid resources by settling cryptocurrency on-chain, then retrying with proof of payment. Built on HTTP 402 'Payment Required'—a status code dormant for decades—x402 enables machine-to-machine commerce without pre-provisioned accounts. Originally proposed by Coinbase, it's designed for autonomous AI agents, API calls, and on-demand services that need instant, per-call settlement.
What is x402?
x402 is a stateless payment protocol layered on the HTTP 402 status code. When a client requests a paid resource, the server responds with a 402 that includes machine-readable payment requirements: amount, accepted asset (typically USDC on an EVM chain), recipient address, and network. The client submits a transaction to settle the payment, then retries the original request with a payment-proof header. The server verifies the proof on-chain and returns the resource. The entire flow takes seconds and requires no account signup, API key rotation, or human intervention—making it ideal for autonomous agents, microservices, and dynamic pricing scenarios. The protocol is HTTP-native and chain-agnostic in design, though most implementations today use Ethereum and its Layer 2 networks for speed and cost.
Why x402 exists: the problem it solves
Traditional API monetization relies on API keys, rate limits, and prepaid accounts—models that break down when the client is an autonomous AI agent with no persistent identity. x402 inverts the problem: instead of identity-first ("prove who you are, then pay"), it enables payment-first ("pay now, we'll serve you"). This is crucial for agent-to-service commerce because it removes the human-in-the-loop, eliminates account friction, and lets any software—including non-custodial agents—transact directly. Each call is a self-contained economic event, settled in seconds.
How x402 works: the flow
The x402 flow is simple. Step one: client makes a GET or POST request to a protected resource. Step two: server returns HTTP 402 with a JSON body containing payment details (amount in wei, asset address, recipient, chain ID, optional nonce). Step three: client constructs and signs a transaction, broadcasts it to the blockchain, and waits for confirmation. Step four: client retries the same request with an `x402-payment` header containing the transaction hash, signature, or proof. Step five: server validates the on-chain transaction (checking amount, recipient, asset) and either serves the resource or returns 402 again if validation fails. No session, no cookies, no persistent state—just proof-of-payment as a primitive.
The identity problem in x402
Because x402 enables payment without identity, services face a new challenge: distinguishing between trustworthy and malicious agents, and complying with AML/KYC rules. A wallet address alone is not an agent identity—it's just a transaction endpoint. This has sparked a wave of reputation and identity layers on top of x402. Services can now ask: "What is the agent's track record?" "Has it been verified?" "Is it operating under a compliant policy?" These questions are pushing the protocol toward a richer ecosystem where agents carry verifiable credentials, reputation scores, and compliance attestations alongside their payment capability.
x402 adoption and the emerging landscape
x402 is still young, but it's attracting builders across agent infrastructure, API monetization, and on-chain commerce. The reference implementation sits at x402.org, and early adopters include gateway providers, AI agent frameworks, and compute platforms looking to bill by the call. Because the protocol is HTTP-standard and chain-agnostic, it can layer onto existing APIs without redesign. Expect to see x402 embedded in agent runtimes, API gateways, and merchant infrastructure as autonomous software becomes the primary consumer of digital services.
Why this matters for AI and autonomous systems
x402 removes a critical blocker for AI agents: the ability to pay for resources without a human operator, bank account, or legal entity. An agent deployed on a cloud provider can now call a paid LLM, a data API, or compute service and settle the cost instantly, in one HTTP round trip. This unlocks new business models (pay-per-inference, dynamic pricing, agent-as-a-customer) and lets services monetize without building identity infrastructure. As agents become more autonomous and interconnected, x402 is likely to become a standard layer in agent-to-service commerce.
How AgentScore implements x402 gating
When integrating x402 into a service, merchant code must decide whether to require payment proof or allow anonymous discovery. AgentScore provides a conditional gating pattern that activates the payment check only when an x402 payment header is present, allowing optional payment flows.
1import { agentscoreGate } from '@agent-score/commerce/identity/hono';
2import { hasPaymentHeader } from '@agent-score/commerce/payment';
3
4// Build the gate once, with the full verification policy.
5const gate = agentscoreGate({
6 apiKey: process.env.AGENTSCORE_API_KEY!,
7 requireKyc: true,
8 requireSanctionsClear: true,
9 minAge: 21,
10 allowedJurisdictions: ['US'],
11});
12
13// Run identity checks ONLY when the request carries an x402 payment proof.
14app.use('/purchase', async (c, next) => {
15 if (!hasPaymentHeader(c.req.raw)) { await next(); return; } // anonymous discovery -> pass through
16 return gate(c, next); // paying agent -> KYC / sanctions / age / jurisdiction
17});The middleware activates payment verification only if an x402 proof header is present, enabling gradual rollout and anonymous-first discovery patterns.
Where this matters in practice
x402 is emerging across multiple layers of the agent and API economy. Infrastructure providers like Stripe and Shopify are exploring payment rails for agent transactions, while API platforms (Infura, Alchemy) are experimenting with x402 as an alternative to API keys. Agent frameworks and runtime platforms are building x402 support to let deployed agents transact autonomously. AgentScore, Verax, and emerging compliance-first agent platforms are layering identity and reputation on top of x402 to solve the trust and regulatory problem. AgentScore provides commerce infrastructure for AI agents, including credential management, reputation lookup (GET /v1/reputation/{address}), and trust assessment with policy evaluation (POST /v1/assess). AgentScore implements x402 by gating resource access conditionally on payment proof headers, enabling merchants to verify agent credentials, accept payments per transaction, and maintain compliance rules without requiring pre-registered accounts or API keys. x402 is reshaping how software pays for services—from identity-first and account-based to payment-first and stateless. As autonomous agents become primary economic actors, x402 and the identity layers building atop it will likely become standard plumbing in the digital economy.
Ready to power your agents with secure commerce?
Join innovators using AgentScore to accept payments, verify buyers, and ensure compliance for every AI-driven transaction.
Read More Blog Posts
Coinbase CDP Unlocks Agent-Native Wallets and Delegated Signing for Autonomous Commerce
Autonomous agents need on-chain transacting capability without human approval loops. Coinbase CDP now ships the infrastructure to make that work. Engineers can
Anthropic's Claude Fable 5: Mythos-Class Speed for Million-Token Workflows
Building agents that reason over massive codebases and run for days requires models that maintain focus and autonomy at scale. Anthropic's Claude Fable 5 brings
