How does an AI agent pay for something?

What is “402 Payment Required”, and why did it sit unused for so long?

HTTP 402 is a status code the web’s founding rulebook reserved for payments and then left empty for almost three decades. Status codes are the short numbers a server sends back with every response. You know 404, “Not Found”. Fewer people know 402.

The code appeared in the HTTP/1.1 specification published in January 1997. No payment format to go with it was ever written, so browsers and servers had nothing to agree on.

The current HTTP standard, published in June 2022, still says the same thing: reserved for future use. In August 2026 an Internet-Draft (an early proposal, not yet a standard) was filed with the internet’s standards body to give 402 a defined meaning at last. You can read the August 2026 Internet-Draft on the 402 status code. Its core definition is simple: the resource needs payment before it will answer, and no acceptable payment has been made.

Why did it take so long? A human with a credit card can sign up for an account once and pay monthly. Software that wants one answer from one service, once, has no such option. AI agents created a customer that needs to pay small amounts, instantly, without a sign-up form.

What actually happens when an agent pays?

The agent and the seller have a short, structured conversation over ordinary web requests, and the money moves as a signed stablecoin transfer. A stablecoin is a crypto token designed to hold a steady value, usually one US dollar. Here is the sequence the x402 documentation describes:

1. The agent asks. It requests a resource: a data feed, a search result, a piece of analysis.
2. The seller names a price. The server replies with code 402 and a payment-requirements message: the amount, who gets paid, and which tokens and networks it accepts.
3. The agent signs a payment. It creates a signed authorisation for that amount from its wallet. Nothing has moved yet.
4. The agent asks again. It resends the original request with the signed payment in a header, a labelled field that travels with the request.
5. The seller checks the payment. It verifies the signature itself or hands that job to a third party.
6. The seller delivers. It returns the resource with a payment-confirmation header, and the transfer is settled on a blockchain.

The whole exchange needs no account, password or card number. That is the point. The agent proves it can pay, rather than proving who it is.

Who checks that the payment is real?

Usually a “facilitator”: an optional service that verifies the signed payment and settles it on-chain so the seller does not have to run blockchain infrastructure. The standard does not require one. A seller can verify and settle on its own.

Facilitators also handle different pricing models. The simplest is a fixed price per request. Another lets the agent authorise a maximum amount, after which the seller charges only what was actually used. A third collects many tiny signed payments and settles them together in one batch.

Batching matters because every on-chain transfer normally pays a network fee. One dollar-stablecoin issuer’s developer documentation says this per-transaction fee is what makes sub-cent payments uneconomical, and that batching spreads the cost across many payments. Its batched service advertises payments as small as one millionth of a dollar.

The payments themselves are small. A crypto trading firm’s report counted about 176 million agent transactions worth about $73 million from May 2025 to April 2026, well under a dollar each. It found 76% of payments fell below the roughly $0.30 fixed fee card networks charge.

Is x402 the only way agents pay?

No. x402 has the most recorded traffic, but it is one of at least four approaches being built in 2026. The same trading-firm report identified four architectures. One is x402. The others are a machine-payments protocol from a large payments company, an agent-payments protocol from a large technology company, and card-network infrastructure adapted for AI shopping.

They solve different problems. x402 suits a machine paying a machine for one small request. Card-based approaches suit an agent buying a pair of shoes for a person, where dispute rights and familiar checkout matter more than speed.

Governance is changing too. In April 2026 the company that contributed x402 handed it to a new x402 Foundation, hosted by a large open-source nonprofit. The announcement said the protocol would stay vendor-neutral. It listed 22 organisations backing the move, including the two largest card networks, large cloud providers and payment processors. We read that as a sign card networks would rather shape agent payments than fight them.

What could go wrong?

The biggest risk is not the protocol. It is an agent that will pay whatever it is asked, as often as it is asked, to whoever asks. The draft standard says this directly. A server can request any amount, and ask again after it has been paid. So automated clients need their own limits on amount, frequency and payee.

Four specific failure points are worth knowing:

• Payment details can be tampered with. The draft warns that a 402 response is only as trustworthy as the connection it arrives on. An attacker in the middle could swap in their own payee, or demand payment where none is owed.
• Paying can reveal who you are. A payment links requests to a payment instrument, and potentially to a person. An agent that is otherwise anonymous gives some of that up when it pays.
• Signed means spent. A stablecoin transfer settles on a blockchain. There is no card-style chargeback built into the protocol, so a bad payment is usually final.
• The headline numbers are soft. Some activity is wash trading, meaning wallets paying themselves to inflate volume. In one 30-day window a widely reported $24 million figure fell to about $1.6 million after one analyst filtered those wallets out. Treat adoption numbers, including those on this page, as directional.

There is also an open question about approval. If every tiny payment needs a human tap, agents are slow. If none do, a mistake or a hijacked agent can drain whatever the wallet holds. The industry has not settled where that line should sit.

The trust takeaway

An agent that can pay is only as safe as the rules around its wallet. x402 makes paying easy; it does not decide what is worth paying for. That judgement still comes from limits a person sets in advance.

Before you let an agent pay for anything, check:

• Is there a spending cap? Per payment, per day and in total, enforced by the wallet rather than the agent’s own reasoning.
• Who can it pay? An allowlist of approved sellers is far safer than paying any server that returns a 402.
• How much does the wallet hold? Fund it with what you are willing to lose to a bug, not your savings.
• Can you see every payment? You want a log of what it paid, to whom, for what, and when.
• Can you stop it instantly? Know how to revoke its payment permission before you need to.