x402 — HTTP 402 Payments

Payments · x402 Foundation (Linux Foundation) · Updated 2026-07-19

Status: Production protocol; stewarded by the x402 Foundation under the Linux Foundation since July 2026 · Authoritative source

The protocol that finally gives HTTP 402 a meaning: a server answers a paid request with a machine-readable challenge quoting price, asset, and recipient, and an agent’s wallet pays and retries — per-call payments with no accounts or API keys.

Two envelope versions coexist. In v1, the challenge is the JSON body of the 402 response; in v2, it moves into a base64-encoded PAYMENT-REQUIRED header with structured service catalogs. The spec ships both, current docs present v2 as current, and AgentGrade’s scanner still observes v1 bodies across deployed services — a client should decode both.

Coined by Coinbase, x402 moved to foundation governance in July 2026: the x402 Foundation launched operationally under the Linux Foundation with roughly 40 members, premier members including Visa, Mastercard, Stripe, Google, AWS, Cloudflare, and Shopify (the canonical repo moved with it; coinbase/x402 continues as a development fork). Chainalysis counted over 100 million x402 agentic payments on Base in the protocol’s first year, and platform support is arriving: Cloudflare’s Monetization Gateway (waitlist) and Amazon Bedrock AgentCore Payments (preview) both speak it natively.

A v1 challenge (simplified)

HTTP/1.1 402 Payment Required
Content-Type: application/json

{"x402Version":1,
 "accepts":[{"scheme":"exact","network":"base","amount":"0.10",
             "asset":"USDC","payTo":"0x…","resource":"/api/report"}]}

How AgentGrade checks it

The Machine Payments group probes for live 402 responses, decodes both envelope versions, and validates /.well-known/x402.json field by field — the only live 402-handshake verification in a scanner. The x402 Checker runs it interactively. Scan your site to see where you stand.

Related

• x402 — the implementation guide
• The full rails + commerce-layer comparison
• x402 Checker — try your endpoint

All standards

RFC 9421 · Web Bot Auth · RFC 8615 · MCP · A2A · x402 · WebMCP · llms.txt · RFC 9309 · RFC 9110 · Index