Coinbase launched x402 in May 2025. Visa, Mastercard, Stripe, and 40 others joined the foundation by July 2026. The rail works and by design it asks nothing about the payer. Here's what that means when regulation arrives.
The Short Version
- x402 is a payment protocol that lives inside HTTP. A server answers an unpaid request with status code 402 and payment instructions; the client retries with a signed stablecoin payment in a header. Coinbase launched it in May 2025 and later contributed it to the Linux Foundation, which operationally launched the neutral x402 Foundation in July 2026 with more than 40 members.
- Adoption is real but needs a careful read. Chainalysis counts over 100 million cumulative x402 transactions on Base through Q1 2026, while noting that much of the late-2025 surge was meme coin activity rather than agents buying services.
- Identity is out of scope by design. The protocol requires no accounts, no personal information, and no KYC from payers. That minimalism drove adoption, and it leaves a question every regulated transaction eventually asks: who is paying?
- Concordium's x402 integration, live since June 2026, adds a verified identity layer to the payment flow. A merchant's 402 challenge can require a ZKP attestation alongside the payment, without the payer exposing personal data.
Autonomous agents are starting to buy things: API calls, datasets, compute, and increasingly real-world goods and services. Before any of that scales, a fairly boring problem has to be solved first. How does a piece of software pay for something on the open web without a human filling in a checkout form?
x402 has become the reference answer, and it is young enough that most explanations of it are either marketing or folklore. This is a close look at what the protocol actually does, what the first year of data says, and the one question it deliberately leaves for other layers to answer.
It opens a series on the layers of the agentic economy, each of which does its own job well and passes the same question, who is behind the agent, to the next: reputation and discovery in ERC‑8004, runtime identity in Google's Agent Identity, and authorization in x401.
Why Agents Need a Payment Rail at All
The web's existing payment machinery assumes a human. Card checkouts want a form, a billing address, and a 3-D Secure challenge. API monetization wants an account, an API key, and a monthly invoice. An autonomous agent that discovers a useful service mid-task can do none of that without a person stepping in, which defeats the point of autonomy.
The HTTP specification anticipated the problem in the 1990s: status code 402, "Payment Required," was reserved for future use and then sat unused for three decades. What was missing was money that software could move natively. Stablecoins supplied that part. x402 is the thin protocol that connects the two: a standard way for a server to say "this costs money" and for a client, human or machine, to pay in the same exchange.
What x402 Specifies
The flow is a single HTTP round trip with one retry:
- A client requests a resource.
- The server responds with status 402 and payment instructions: price, accepted asset, network, and where to pay.
- The client retries the request with a signed payment authorization in an X-PAYMENT header.
- A facilitator verifies the signature, settles the payment on-chain, and the server returns the resource, with settlement details in an X-PAYMENT-RESPONSE header.
The facilitator is the piece that keeps sellers out of blockchain operations: it verifies and settles payments so the server never has to run a node or hold keys. Coinbase hosts one that processes ERC-20 payments on Base, Polygon, Arbitrum, World, and Solana, using EIP-3009 authorizations for USDC and EURC or Permit2 for any ERC-20 token, and the protocol allows anyone to run their own. The specification's design principles center on trust minimization: neither the facilitator nor the resource server can move funds beyond what the client signed.
Two more design facts matter for what comes later in this piece. First, x402 is deliberately minimal: a payer never creates an account or hands over personal information, and there is no KYC step anywhere in the flow. Second, the protocol includes an extension mechanism, so a 402 challenge can carry requirements beyond price. Both are deliberate choices, and both shape where x402 fits in a regulated economy.
Who Is Behind It, and Where It Stands
Coinbase launched x402 in May 2025 as an open standard. Cloudflare partnered with Coinbase in September 2025 to start a foundation around it, and the protocol then moved to genuinely neutral ground. The Linux Foundation announced the x402 Foundation in April 2026, fittingly on the second of the month (4/02, after the HTTP status code), and operationally launched it in July 2026, with Coinbase contributing the protocol itself and more than 40 members signing on. The premier members are a roster of nearly everyone in payments: Visa, Mastercard, American Express, Stripe, Adyen, Fiserv, Google, Amazon Web Services, Circle, Ripple, Shopify, and the Solana Foundation among them. Separately, Google had already wired x402 into its Agent Payments Protocol as the crypto settlement extension, co-developed with Coinbase, the Ethereum Foundation, and MetaMask. Inside about a year, x402 went from one company's launch to the standard the rest of the industry organized around.
The usage numbers deserve the same honest read we would give anyone's numbers. Chainalysis, working from on-chain data, found that x402 transactions on Base grew from near zero in mid-2025 to well over 100 million cumulative transactions through Q1 2026. Chainalysis also notes that a large share of the late-2025 surge came from PING meme coin activity instead of agents purchasing services, so the figure measures protocol traffic, not proven agentic commerce. The protocol's own dashboard at x402.org showed roughly 75 million transactions and $24 million in volume for the trailing 30 days when we checked in mid-July 2026; treat those as the vendor's figures, dated to the day you read them.
The fair summary: the rail works, the ecosystem behind it is serious, and the volume is real but noisy. That is a normal first year for payment infrastructure.
What x402 Deliberately Leaves Out
x402.org advertises "no accounts or personal information needed" as a headline feature. Identity, KYC, and compliance do not appear in the specification. This is the protocol's philosophy, not an oversight, and for adoption it was the right call: a payment rail that asks nothing about the payer is the easiest possible rail to implement, for developers and for agents alike.
The limits appear the moment an agent buys anything the law cares about. Age-restricted goods, jurisdiction-gated services, and anything regulated as a financial product all require someone in the chain to establish facts about the buyer. European platforms operate under MiCA and a tightening set of age-verification mandates. US stablecoin legislation is pulling issuers and facilitators toward bank-grade obligations. Chainalysis, watching the volumes climb, framed the compliance question for agentic payments as "less about whether to prepare and more about when."
None of this is a flaw in x402, any more than HTTP is flawed for not including passwords. It is a scope decision, and it defines what has to live in the layers around the rail.
The Industry's Other Answers to "Who Is Paying"
Here is the telling part: several of those x402 Foundation members are, in parallel, building their own answers to the identity question. The designs are instructive because they all share one property.
- Visa's Trusted Agent Protocol (October 2025, with Cloudflare) signs an agent's identity into HTTP message headers so merchants can check it against a Visa-operated directory. It verifies the agent and moves no money.
- Mastercard's Agent Pay binds a tokenized credential to a specific agent, with limits set per session and per merchant, and extended to machine customers in June 2026.
- Google's AP2 binds a cryptographic mandate to the human user who instructed the agent, and delegates agent identification to Visa's protocol.
- The Agentic Commerce Protocol from Stripe, OpenAI, and Meta issues single-use, amount-capped payment tokens and leaves identity verification out of scope.
Each of these places identity beside the payment: a wrapper around the request, a directory lookup, a mandate held by a different party than the one settling the funds. That architecture suits card rails, which already carry decades of dispute machinery. For x402, whose appeal is that one HTTP exchange does everything, the more natural fit is the protocol's own extension mechanism: let the 402 challenge itself ask for what the seller is required to know.
Where Concordium Fits: Identity Inside the Payment
That is the slot Concordium's integration fills. Live since June 2026 and built with Boosty Labs, a Coinbase Developer Platform ecosystem partner, it keeps x402's shape and adds one element. The server's 402 response carries a price. The agent replies with the stablecoin payment, and as the integration matures, any specific attestation a merchant might request like age or jurisdiction.
The proofs come from Concordium's identity layer, which is part of the chain itself: every Concordium account is anchored to an identity verified through regulated identity providers, with zero-knowledge selective disclosure built in. The same substrate carries Protocol-Level Tokens: native tokens implemented in the protocol rather than in smart contracts, where every holding wallet is identity-backed while no personal information is stored on-chain, and where issuers get compliance controls such as allowlists and denylists.
The Stack at a Glance
Read the table as a stack, not a contest. One row of it moves money; the other says who moved it and whether they were allowed to.
When You Need Which
If your service sells compute, data, or API calls with no regulatory strings, plain x402 is enough, and its minimalism is exactly why you would choose it. Nothing about adding identity later requires re-architecting: the extension slot is already in the protocol.
If your service is age-gated, jurisdiction-bound, or regulated, or your risk team needs to prove after the fact that a verified party authorized each payment, the rail alone cannot get you there. That is when the 402 challenge needs to carry an attestation requirement, and when the payer needs an identity layer that can answer it without handing over documents. That combination, payment and proof in one exchange, is what the Concordium integration exists to provide.
An agent economy will need both layers, for the same reason the web needed both HTTP and TLS. x402 tells the agent how to pay. Concordium tells the seller who is paying, and proves it to no one else.
The checkout form is gone; the question it used to answer, who is on the other end, is not.