The handshake, step by step
- 1. Request: agent calls the tool endpoint like any HTTP client.
- 2. 402: server refuses with
402 Payment Required plus machine-readable terms (price, asset, pay-to address).
- 3. Pay: the agent's wallet signs a USDC transfer authorization — no signup, no API key, no card form.
- 4. Retry: same request re-sent with an
X-PAYMENT header; a facilitator verifies and settles on-chain.
- 5. Run: server executes and returns the result. Loop.
Why 402 sat unused for ~25 years
Status 402 was reserved in the HTTP/1.1 spec (1997) "for future use" — the web never got native payments, so cards + subscriptions filled the gap. Stablecoins made cent-and-below machine-to-machine payments practical; Coinbase published the x402 spec in 2025 to standardize the pattern.
The guardrails lesson
Autonomy cuts both ways. A looping agent with a wallet is a
runaway-spend risk (bugs, prompt injection, malicious tools). Real deployments need:
budget caps (watch the sim halt when spend would exceed the cap),
allowlists of payable endpoints, per-call price ceilings, and audit logs of every payment.