x402

x402 is an open HTTP-native payment protocol that revives the long-dormant HTTP 402 Payment Required status code as a machine-payable handshake. Servers gate API responses on payment; clients retry with proof of payment. Designed for AI agents, machine-to-machine commerce, and any caller without a human in the loop. Reference spec at x402.org. Created at Coinbase, the protocol is now governed by the x402 Foundation under the Linux Foundation, and the canonical repo lives at github.com/x402-foundation/x402.

Client requests a paid endpoint. Server responds 402 Payment Required with a JSON body containing x402Version, resource, and an accepts array (scheme, network, amount, asset, payTo, maxTimeoutSeconds). For the Coinbase reference exact scheme on EVM networks like Base, the client signs an EIP-3009 transferWithAuthorization (gasless from the agent’s side), wraps it as a PaymentPayload (signature plus authorization fields from, to, value, validAfter, validBefore, nonce), and base64-encodes the result. The client retries with header X-PAYMENT set to that base64 string. The server’s facilitator broadcasts the authorization, verifies on-chain settlement, and returns 200 with the data plus a PAYMENT-RESPONSE header containing the settlement receipt. No accounts, no API keys for billing, no signup form, no invoice cycle.

Base MCP (mcp.base.org, launched May 2026) is Coinbase's official transact-side MCP server. It connects an agent to a Base Account and lets the agent propose swaps, transfers, and x402 payments that the user approves in-wallet. From an x402 perspective, Base MCP is the canonical agent-side wallet client: it handles the EIP-3009 signature, the X-PAYMENT header, and the per-payment maxPayment approval modal without the agent ever holding private keys. Discovery still happens upstream of Base MCP: the user or upstream agent supplies the endpoint URL, and Base MCP detects the x402 payment requirement by reading the 402 response. It does not crawl Bazaar or x402scan. On the publisher side, the merchant API still needs an x402-compliant /.well-known/x402 manifest and a canonical 402 Payment Required response. TensorFeed pairs with Base MCP cleanly: TF's premium endpoints publish a canonical V2 manifest, Base MCP signs the payment, and the @tensorfeed/x402-base-mcp verify MCP independently confirms settlement on-chain.

As of September 2026, the spec is governed by the x402 Foundation under the Linux Foundation, which launched operationally on July 14, 2026 with 40 members (premier members include AWS, Cloudflare, Coinbase, Google, Mastercard, Stripe, and Visa). Live adopters include the Coinbase CDP Facilitator (Base, Polygon, Arbitrum, World, and Solana; its x402 Bazaar discovery API listed 15,406 resources on September 14, 2026), the PayAI Facilitator, Pay.sh (Solana Foundation and Google Cloud), AWS WAF AI traffic monetization (launched June 15, 2026), Amazon Bedrock AgentCore Payments (generally available August 18, 2026), TensorFeed (AFTA-certified, payable on Base or Solana), and TerminalFeed (federated with TensorFeed via the AFTA cross-Worker rail). Stripe machine payments (x402) is in preview: a PaymentIntent issues a standard x402 exact challenge and Stripe captures once USDC settles on Base. Cloudflare has announced a Monetization Gateway with a waitlist open. SDKs include the foundation's @x402/* packages (successors to @coinbase/x402), the Cloudflare Agents SDK, and the tensorfeed Python and JavaScript SDKs; the afta-gateway Cloudflare Worker template and the tensorfeed-mcp server round out the list. Live adopter directory at tensorfeed.ai/x402-adopters.

Traditional payment APIs assume a human at a keyboard filling out a signup form, attaching a credit card, and copying an API key. AI agents have none of those primitives. x402 lets agents act on their own spending decisions in a single round trip, settling on-chain in seconds with no chargebacks, no merchant-account termination risk, and microtransactions that are economically viable (sub-cent gas on L2s like Base). Stripe itself now issues standard x402 exact challenges in its machine payments preview, settling USDC on Base, so the protocol is cooperative not adversarial.

In x402 V2, services that support the protocol publish a discovery manifest at /.well-known/x402 listing every paid endpoint with its accepts block (asset, network, amount, payTo), input/output schemas, and metadata. Facilitators like CDP Bazaar and x402scan crawl this manifest to auto-index services so x402-compatible agents can discover them without manual directory submission. TensorFeed publishes its manifest at /.well-known/x402.json.

Two coexisting formats are in the wild as the protocol matures. V1 is the original Coinbase reference (network and asset declared as separate fields). V2 added the discovery manifest and the eip155-style network identifier (e.g. eip155:8453 for Base mainnet). x402scan currently lists V2 publishers; x402.org documents both. The cleanest path for new publishers is V2 with the well-known manifest plus an x-payment-info extension on each paid OpenAPI operation.

Three options ranked by effort. Drop-in: fork github.com/RipperMercs/afta-gateway, set 3 secrets (Worker secret, USDC payTo wallet, Ed25519 receipt signing key), deploy. Library: install the x402 Foundation packages (@x402/core plus the Express, Hono, Fastify, or Next.js adapter) and add the middleware to your app. Hand-rolled: implement the 402 handshake yourself in ~50 lines, verify the X-Payment-Tx receipt against an RPC node. The afta-gateway template is the recommended path for any publisher who also wants AFTA primitives (signed receipts, code-enforced no-charge ledger).