The one-line version: on July 14, 2026 the Linux Foundation put a neutral governance body around x402 — the protocol that revives the dead HTTP 402 status code so software can pay for a request the way it already sends one — and got 40 members to sign on, including Visa, Mastercard, American Express, Stripe, Adyen, Fiserv, AWS, Google, Cloudflare, Shopify, Circle, Coinbase, and Ripple. If you're building agents, the protocol didn't change this week. The politics did, and that's the part that decides whether you build on it.
What actually happened#
x402 is not new. Coinbase shipped it in 2025, and it has been quietly settling machine payments since. What launched on July 14 is the x402 Foundation, hosted under the Linux Foundation's neutral governance — the same institutional pattern that made Kubernetes and Linux itself safe to build a company on. Coinbase contributed the protocol to the foundation; the card networks, cloud providers, and stablecoin issuers joined the table.
The membership is the story. When Visa, Mastercard, Amex, Stripe, Adyen, and Fiserv are in the same standards body as Coinbase, Circle, Ripple, and the Solana and Stellar foundations, the message to a builder is: you no longer have to guess which agent-payment rail wins. The people who would each have shipped an incompatible one agreed to share.
How x402 works, in one screen#
The mechanism is deliberately boring, which is why it scales:
- Your agent makes a normal HTTP request to a paid endpoint.
- If payment is required, the server answers
402 Payment Requiredwith a structured header naming the price, accepted tokens, recipient address, and settlement network. - The agent builds a signed payment payload — a gasless EIP-3009 authorization for USDC/EURC, or Permit2 for other ERC-20 tokens — and retries the request with the proof attached.
- The server verifies and returns the data.
No account. No API key. No subscription. The cycle takes seconds and settles on-chain, most commonly in USDC on Base or Solana, picked for low fees and fast finality. Launch-week coverage put recent activity near 75 million transactions settling roughly $24M in a 30-day window, at zero protocol fees. Read those figures as outlet-reported rather than audited — but this is production traffic, not a demo.
Why a founder should care#
The decision x402 changes is "do I make a caller sign up before they can pay me?" For a known customer with a billing contact, a subscription and an API key are still the right call. But for the long tail — an agent hitting an API it will use twice, a data feed you consume rarely, a service you'd never sign a contract with — pay-per-request wins, and now it has a rail that a neutral body governs.
| x402 (pay-per-request) | API key + subscription | |
|---|---|---|
| Onboarding | None — agent pays on first call | Sign up, add a card, get a key |
| Granularity | Per request, sub-cent possible | Per plan, monthly minimums |
| Settlement | USDC on-chain, seconds | Card rails, monthly invoice |
| Best for | Machine-to-machine, long-tail APIs | Known, high-volume relationships |
The part that didn't change#
x402 is the settlement layer — it moves money. It does not prove a human sanctioned the spend, and it is not a checkout. Those are separate layers you still need:
- Authorization — Google's AP2 issues a signed mandate proving a person told the agent it could spend, on what, up to how much.
- Commerce — OpenAI and Stripe's ACP handles discovery, cart, and checkout inside an assistant.
A full agentic purchase can touch all three: AP2 to authorize, ACP to check out, x402 to settle. We laid out the stack — and why treating them as rivals is a category error — in AP2 vs x402 vs ACP. If you want to gate your own API behind a 402 at the edge, AWS CloudFront can now charge agents per request.
How to try it this week#
You don't need to touch a wallet library to prototype. Use a facilitator — Coinbase's Developer Platform runs a hosted one that verifies and settles ERC-20 payments across Base, Polygon, Arbitrum, World, and Solana, with a free tier of 1,000 transactions per month. Point an agent at a real 402-gated endpoint, let the facilitator handle the signing and settlement, and watch the retry succeed. That's the entire loop, and it's enough to decide whether pay-per-request belongs in your product before the standard finishes hardening under its new, neutral governance.
