What is x402? A plain-English explanation
Updated August 6, 2026
x402 is an open, HTTP-based standard that lets software agents and machines pay small amounts, often under a dollar, for a web page, an API, or an AI tool, settling automatically without a person in the loop. Visa, Mastercard, American Express, Stripe, and Google are now behind it, through a Linux Foundation body called the x402 Foundation.
The 402 status code sat unused for decades
HTTP status codes are the three-digit numbers a server sends back with every response: 200 for OK, 404 for not found, 500 for a server error. When the HTTP/1.1 specification was written in the 1990s, engineers reserved code 402, "Payment Required," for future use and then never built that future. Browsers never learned what to do with it, so it sat in developer documentation as a curiosity for close to thirty years.
Coinbase picked that code up in May 2025 and built a real protocol around it, naming it x402 after the status code itself. The idea is simple even if the plumbing underneath isn't: instead of redirecting a visitor to a paywall page, a server can return status 402 along with machine-readable payment instructions in the response. A script, an AI agent, or a wallet reads those instructions, pays, and resends the request, all within the same exchange.
Who actually runs it now
In April 2026 the Linux Foundation, the nonprofit that also stewards the Linux kernel and a long list of other open-source infrastructure, said it would take over governance of x402 from Coinbase. That became official on July 14, 2026, when the Foundation announced the operational launch of the x402 Foundation with around 40 member organizations already signed on.
The member list is the part worth sitting with. It isn't a niche crypto lineup. Premier members include:
- Visa, Mastercard, and American Express
- Stripe, Google, and Amazon Web Services
- Coinbase, Circle, Ripple, and MoonPay
- Cloudflare, Shopify, Adyen, and Fiserv
- The Solana Foundation and the Stellar Development Foundation
That's card networks, a card issuer, a search and cloud company, several payment processors, and multiple blockchain foundations, all building on the same 402 handshake. This stopped being one company's side project the day that list came together.
What happens during an actual x402 payment
The flow itself is short. Here's roughly what it looks like end to end.
| Step | What happens |
|---|---|
| 1. Request | A client (an app, script, or AI agent) requests a page or API resource over normal HTTP |
| 2. 402 response | The server replies with status 402 and a JSON payload: network, asset (usually USDC), price, recipient address, expiry |
| 3. Signed payment | The client signs a payment and resends the request with an X-PAYMENT header, no card form or account login needed |
| 4. Settlement | A facilitator, Coinbase runs a widely used one, verifies the signature and confirms the transfer on chain |
| 5. Delivery | The server returns the resource along with an X-PAYMENT-RESPONSE header confirming the transaction went through |
USDC is the dominant settlement asset right now, moved through a gasless signing method (EIP-3009) so the payer doesn't need to hold a separate token just to cover network fees. Cloudflare's own x402 documentation lists support across ten networks, including Base, Ethereum, Polygon, Solana, and Stellar, with USDC as the settlement currency on each. In the month before the Foundation's formal launch, reporting citing Foundation figures put x402 volume at roughly 75 million payments worth a combined 24 million dollars, averaging about 32 cents per transaction. Those are still early numbers for a protocol that's barely a year old, and I'd treat any of them as a snapshot rather than a trend.
Why this matters if you run a site
Cloudflare joined the x402 Foundation as a member and built its Monetization Gateway on top of the protocol, announced July 1, 2026. That gateway is the plumbing behind Cloudflare's bigger shift on AI crawlers: starting September 15, 2026, the default setting flips to blocking mixed-use crawlers, the kind that blend search indexing, agent browsing, and model training, on any page that carries ads, unless the site owner explicitly allows the crawler or charges for access. x402 is the mechanism most likely to sit behind that charge box. I've walked through what the September 15 switch actually changes for an ordinary blog or newsletter site in a separate piece on getting paid when AI reads your site.
It isn't only for crawlers
Because x402 settles in USDC and similar stablecoins, the same rails that let a server charge an AI agent 32 cents can also carry a payment from one person to another. That's a different lane from something like Meta's stablecoin payouts to creators, which route through Stripe's infrastructure on Polygon and Solana rather than a 402 handshake, but both point at the same shift underneath: stablecoins are becoming ordinary payment rails, not a side channel for enthusiasts.
x402 still assumes the paying party already runs software built to notice a 402 response and sign a stablecoin payment on its own, whether that's an AI agent, a script, or a wallet built for it. An ordinary visitor browsing with a regular browser and no compatible wallet can't pay through it at all, so for now x402 fits machine-to-machine and agent-to-server payments far better than it fits a normal human checkout.