# x402 Payment Protocol

> Revives the dormant HTTP 402 status code: a server answers a request with 402 and machine-readable payment requirements, the agent signs and pays in stablecoin, a facilitator verifies and settles on-chain, and the request is retried with a payment header. Governance transferred to the vendor-neutral x402 Foundation under the Linux Foundation in 2026, with 40 founding members including Visa, Mastercard, Stripe, Adyen, and AWS.

## At a glance

| Field | Value |
| --- | --- |
| Name | x402 |
| Layer | payment-execution |
| Category | onchain |
| Status | live |
| Created by | Coinbase |
| Launched | 2025-05 |
| Rails | USDC, Base, Solana, stablecoins |
| Settlement | On-chain stablecoin (USDC) settled via facilitators. |
| Reversible | no |
| Human in loop | none |
| D2C fit | moderate |
| B2B fit | strong |
| Spec | https://www.x402.org/ |
| Last verified | 2026-09-03 |

## How it works

x402 turns the long-unused **HTTP 402 "Payment Required"** status into a working payment handshake between clients and servers, with no accounts or API keys.

1. **Challenge.** A client requests a protected resource. Instead of `200`, the server returns **`402`** with a machine-readable body describing what is owed — amount, asset (typically USDC), destination, network, and an expiry.
2. **Pay.** The client (an agent's wallet) constructs and **signs a payment payload** authorizing the transfer, and retries the request with the signed payload attached in an `X-PAYMENT` header.
3. **Verify & settle.** The server hands the payload to a **facilitator** — a pluggable service that verifies the signature and settles the transfer on-chain. Merchants can use a hosted facilitator or self-host their own.
4. **Fulfil.** Once settlement is confirmed, the server returns the resource (`200`) along with a settlement receipt.

Because settlement rides on stablecoin rails, payments are **push-based and final**. The design contemplates **deferred/batched settlement** so that many sub-cent calls can be aggregated rather than settled individually, mitigating per-transaction gas overhead.

**Protocol V2** (mid-2026) introduced CAIP-2 network identifiers, scoped `@x402/*` npm packages, new header names (`PAYMENT-REQUIRED`, `PAYMENT-SIGNATURE`, `PAYMENT-RESPONSE`), a Bazaar discovery extension, and support for `exact`, `upto`, and `batch-settlement` payment schemes. Coinbase contributed the protocol to the **Linux Foundation** in April 2026; the x402 Foundation became operationally active in July 2026 with 40 members spanning payments incumbents (Visa, Mastercard, Amex, Adyen, Fiserv, Stripe), cloud providers (AWS, Google, Cloudflare), and blockchain ecosystems.

## Tradeoffs

- Payments are non-reversible: there is no built-in chargeback, dispute, or refund mechanism, so error handling and trust must be solved out-of-band.
- Latency is bounded by on-chain confirmation, which is slower than an authorize-now/capture-later card flow.
- Sub-cent, per-call pricing runs into gas economics unless calls are batched or deferred.
- Custody shifts to the agent: the paying party must hold and manage keys (MPC wallets or scoped session keys), expanding the attack surface.

## Security & limitations

- Documented attack classes include unpaid-service and paid-but-denied failures, where either side of the exchange defaults after the other performs.
- Payment metadata (resource URL, description, reason) can travel in plaintext, creating PII-leakage and transaction-linkability risk.
- Prompt-injection against the paying agent can induce fraudulent or over-value payments, since the agent both decides and authorizes.
- Replay and overpayment drain are concerns without strict nonce/expiry handling and per-request payment caps.

## Fits together with

- stripe-mpp
- erc-4337

## Sources

1. [x402 — official protocol site](https://www.x402.org/) — x402 Foundation
2. [x402 documentation (Welcome)](https://docs.cdp.coinbase.com/x402/docs/welcome) — Coinbase Developer Platform
3. [x402 Foundation — reference implementation (post-contribution)](https://github.com/x402-foundation/x402) — x402 Foundation (GitHub)
4. [Linux Foundation Announces Operational Launch of x402 Foundation](https://www.linuxfoundation.org/press/linux-foundation-announces-operational-launch-of-x402-foundation-to-standardize-internet-native-payments-for-ai-agents-and-applications) — Linux Foundation, 2026-07-14
5. [Linux Foundation is Launching the x402 Foundation (initial announcement)](https://www.linuxfoundation.org/press/linux-foundation-is-launching-the-x402-foundation-and-welcoming-the-contribution-of-the-x402-protocol) — Linux Foundation, 2026-04-02
6. [Migration Guide: V1 to V2](https://docs.x402.org/guides/migration-v1-to-v2) — x402 Foundation

---
_Source: payful.ai — independent editorial reference. Verified 2026-09-03._