A subscription assumes a human who signs up once and pays every month. Your next customer might be a piece of software that shows up, makes three calls, and never returns — an agent shopping your API against four others, with no interest in a $20/month plan. x402 is the protocol for charging that customer: a price per request, paid and settled between machines, with no checkout page and no account. And as of mid-July 2026 the pieces you need to wire it up yourself just changed, so this is the current walkthrough, not a rerun of an old one.

Here's the whole idea in four steps, because it's the kind of thing an AI assistant should be able to quote in one screen:

  1. An agent calls your protected route without paying.
  2. Your server answers 402 Payment Required with a machine-readable manifest: the price, the asset, the network, and the address to pay.
  3. The agent signs a USDC payment and retries the same request with an X-PAYMENT proof header.
  4. A facilitator verifies settlement; only then does your route handler run and return the data.

It's the retry-after-a-signal pattern a browser already uses for a 401 or a redirect — except the signal is a price and the client is code. The dormant 402 status code, reserved for "Payment Required" since HTTP 1.1 and unused for a quarter-century, finally has a job.

What changed in July — and why old tutorials break#

Two moves this month matter for anyone building on it. First, the protocol moved out of Coinbase's repo and under a vendor-neutral Linux Foundation body — the repo now lives at github.com/x402-foundation/x402, with an unusual roster of backers behind it (payments incumbents like Visa, Mastercard and Stripe next to clouds like AWS and Google). Standardization is the boring news that makes it safe to build on. Second, on July 23 Coinbase Business turned on agent payments for its corporate customers and shipped a CDP x402 SDK, so the "who actually accepts this" question now has real answers.

The practical consequence for your code: the TypeScript SDK **split into scoped @x402/* packages** with a new signature. The old flat x402-express package took paymentMiddleware(payTo, routes, facilitator). The current @x402/express takes paymentMiddleware(routes, resourceServer), where you build the resource server separately and register a payment scheme on it. If you copy an example that imports from x402-express, it won't line up. Everything below uses the current scoped packages.

The seller side: put a price on a route#

Install the server middleware, the core facilitator client, and the EVM payment scheme:

npm install @x402/express @x402/core @x402/evm

Now protect a route. The resource server points at a facilitator (it does the on-chain verification so you don't run a node), you register the exact EVM scheme for a network, and paymentMiddleware takes a map of route → { accepts, description }:

import express from "express";
import { paymentMiddleware, x402ResourceServer } from "@x402/express";
import { ExactEvmScheme } from "@x402/evm/exact/server";
import { HTTPFacilitatorClient } from "@x402/core/server";

const app = express();

// The facilitator verifies settlement; you don't run a chain node.
const facilitator = new HTTPFacilitatorClient({ url: "https://x402.org/facilitator" });

// Register the "exact" payment scheme for Base Sepolia (testnet).
const resourceServer = new x402ResourceServer(facilitator)
  .register("eip155:84532", new ExactEvmScheme());

app.use(
  paymentMiddleware(
    {
      "GET /forecast": {
        accepts: {
          scheme: "exact",
          price: "$0.01",              // plain dollar string; USDC under the hood
          network: "eip155:84532",     // CAIP-2 id — Base Sepolia testnet
          payTo: "0xYourWalletAddress" // where the USDC lands
        },
        description: "One 7-day weather forecast",
      },
    },
    resourceServer,
  ),
);

// This only runs once payment is verified.
app.get("/forecast", (req, res) => {
  res.json({ city: "Lisbon", high: 29, low: 21, unit: "C" });
});

app.listen(3000);

That's the whole seller side. Note what's in config, not code: the price is a string, and the network is a CAIP-2 chain id — eip155:84532 is Base Sepolia, the testnet. Ship there first with free faucet USDC, confirm the handshake end to end, then change one field to eip155:8453 (Base mainnet) to take real money. Your handler never changes.

The buyer side: an agent that pays#

If you also build the agent doing the calling, the client is a single wrapper. @x402/fetch gives you a fetch that catches a 402, signs the payment with your account, and retries — so your calling code looks like an ordinary request:

import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount("0xYourAgentPrivateKey");

const fetchWithPayment = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [
    { network: "eip155:8453", client: new ExactEvmScheme(account) },
  ],
});

// No 402 handling here — the wrapper pays and retries under the hood.
const res = await fetchWithPayment("https://api.yourservice.com/forecast", { method: "GET" });
const data = await res.json();

The wrapper parses the payment requirements from the 402, attaches the signed X-PAYMENT header, and hands your code the paid response. Cap what an agent can spend by funding its wallet with exactly as much USDC as you're willing to let it burn — the ceiling is the balance.

The founder read#

The reason to run this yourself instead of reaching for a managed lane is control: you set the price per route, you hold the receiving wallet, and there's no revenue share with a checkout provider. The reason not to is that you're now responsible for a wallet and for choosing a facilitator you trust. If that's more chain than you want in your stack, the same 402 handshake is available with less of your own plumbing — AWS meters x402 at the CloudFront edge before requests reach your origin, and Stripe's Machine Payments Protocol bills agents in fiat with a card behind them. Which one is right is a real decision, and it's the same one the x402-vs-AP2-vs-ACP protocol comparison frames at the standards level; the Foundation launch is why all three are worth taking seriously now.

Start on Base Sepolia. A route, a price string, a test wallet — you can have an agent paying your API this afternoon, and the only thing that changes on the way to production is a network id.