x402 is an open protocol that turns the dormant HTTP 402 status code into a machine-readable payment negotiation, letting AI agents pay per API call in stablecoins via third-party facilitators; the standard has won institutional backing but the transaction demand behind it collapsed roughly 77% between November 2025 and May 2026.
Summary
x402 extends the long-unused HTTP 402 “Payment Required” status code into a full payment handshake. A server responds to an unpaid request with the price and accepted terms, the client (typically an autonomous agent) signs a payment authorisation, and a third-party facilitator verifies the payment proof and performs on-chain settlement, usually a USDC transfer on Base or Solana. The merchant never touches a chain. That design is the protocol’s central bet and its central risk: facilitators become shared payment infrastructure for many independent merchants, so trust and validation concentrate in one component.
The parameters that decide it are three. First, per-transaction economics: batch settlement reached spec status on 11 May 2026, letting a buyer fund an escrow once and then sign off-chain vouchers redeemed in a single on-chain transaction. That is the sub-cent unlock, and it also breaks the on-chain measurement that everyone currently uses. Second, demand: on-chain volume peaked at about $5.15M in November 2025 and fell roughly 77% to $1.19M by May 2026, with 2.89M transactions at about $0.52 average size, and a large wash component (roughly 50% by count, over 80% by value) ref. Third, facilitator safety: the first systematic security study of live deployments found violations of eight basic authorisation and execution rules, yielding four attack classes named Free Shopping, Asset Theft, Service Denial and Gas Abuse.
A fourth complication is that nobody agrees what the volume actually is. x402.org’s own panel reads 75.41M transactions and $24.24M over the 30 days to 21 Jul 2026, roughly 20x what independent trackers show for comparable windows (x402scan $1.11M, Major Matters $1.2M), and that discrepancy is unresolved ref.
Evidence base
- Coinbase released x402 v1 on 6 May 2025 and V2 in Dec 2025; the Linux Foundation took the contribution on 2 Apr 2026 and the x402 Foundation launched operationally with 40 members on 14 Jul 2026, including Visa, Mastercard, Amex, Stripe, Adyen, Fiserv, Google, AWS, Cloudflare, Circle, Shopify and Ripple ref.
- Zero protocol fees and no native token are confirmed in the docs: there is nothing to own at the protocol layer ref.
- On-chain volume peaked at about $5.15M in Nov 2025 and fell roughly 77% to about $1.19M by May 2026, with 2.89M transactions at about $0.52 average size ref.
- CoinDesk, 11 Mar 2026: real commerce was running at about $28k/day with roughly 50% wash or self-dealing per Artemis; wash is estimated at ~50% by count and over 80% by value.
- The first systematic study of live facilitator-mediated x402 deployments (23 Jul 2026) found violations of eight facilitator security rules and derived four attack vectors: Free Shopping, Asset Theft, Service Denial and Gas Abuse.
- Batch settlement reached spec status on 11 May 2026, allowing a buyer to fund an escrow once and redeem off-chain vouchers in a single on-chain transaction, the sub-cent economics unlock ref.
- Mastercard launched Agent Pay for Machines on 10 Jun 2026: agent-to-agent, sub-cent, with guaranteed settlement.
Open questions
- Which measurement is right: x402.org’s 75.41M transactions and $24.24M over the 30 days to 21 Jul 2026, or the $1.11M-$1.2M read by x402scan and Major Matters for the same window?
- Once batch settlement (spec 11 May 2026) is widely deployed and vouchers move off-chain, what public signal remains for measuring real x402 demand at all?
- Do the facilitators named in the July 2026 security study remediate the eight rule violations, and does a loss event occur first?
- Does Mastercard’s Agent Pay for Machines, with its settlement guarantee, take the sub-cent agent-to-agent use case that x402 is targeting?
Assessment drafted 2026-08-31 from up to 11 KB sources using the technology-scorecard framework; scores are a draft read pending review.