The coin slot the web forgot: how AI agents are learning to pay

A plain-English tour of x402 and agent payments — what they are, why your credit card can't do the job, and how to tell the real signal from the hype.

Picture this. You ask your AI assistant to pull together a market brief. It finds the perfect data source — one clean API call, ten cents. It knows exactly what it needs. And then it stops. Not because it's confused. Because it has no way to pay ten cents for one thing.

The whole modern web assumes a human is sitting there, credit card in hand, ready to click "Buy." An agent has no hands, no card, and no checkout page to tap. It hits the paywall and just… waits.

This is the problem a small, strange-looking protocol called x402 is trying to solve. And the story starts with a status code that sat unused for thirty years.

A status code that waited thirty years for a job

Every time you open a web page, your browser and the server have a tiny conversation you never see. The server answers with a short number — a status code (the web's built-in reply codes). You already know a couple of them without realising. "404" is the one you meet when a page is missing. "200" quietly means "here you go, all good."

Back in the 1990s, the people who designed the web reserved one of these numbers for a future that hadn't arrived yet: 402, "Payment Required." They suspected that one day the web might need to charge for things directly, machine to machine. So they set the number aside. And then — for about thirty years — nobody used it. It was a light switch wired to a room that didn't exist.

x402 is what happens when someone finally builds the room. Coinbase took that dormant 402 code and turned it into a working payment protocol (a shared set of rules for how machines pay each other). The "x" is just a nod to "extend." The web had a coin slot in its blueprints the whole time. x402 installs it.

The teaching: "The web was designed to charge money from day one. It just took thirty years — and a wave of AI agents that need to buy things — for anyone to flip the switch."

The handshake, in five steps

Let me walk you through one payment, slowly, because once you've seen it happen once the whole idea clicks into place.

An agent — let's call her Ada — wants one thing: a single call to a weather API. No account. No subscription. Just this one call.

1. Ada asks. She sends a normal web request: "give me the forecast for Bristol."
2. The server says pay first. Instead of "200, here you go," it replies "402, Payment Required" — and attaches a little machine-readable note: how much (say $0.001), in what currency, on which network, and where to send it.
3. Ada pays and asks again. She builds a signed payment — think of it as a digital coin with her signature on it — and re-sends the exact same request, this time with the coin attached. She does this herself, in code. No human clicks anything.
4. A middleman checks the coin. A service called a facilitator (a referee that verifies the payment and settles it) confirms the coin is real and moves the money. This means the weather company never has to become a payments company.
5. The server hands over the goods. Coin confirmed, it answers "200, here you go" — with the forecast.

Start to finish: a couple of seconds. Cost: a fraction of a cent. And Ada can repeat this a thousand times a day without tiring and without a human approving each one.

The teaching: "x402 is a coin slot built into the web itself. Ask, get told the price, drop the coin, get the thing — the one handshake a machine can run all day."

Why your credit card can't do this

The obvious question — the one I asked first — is: why not just give the agent a credit card?

Here's the wall you hit. A card swipe costs roughly thirty cents plus a slice of the sale, every single time. That's fine for a £40 dinner. It's absurd for a $0.001 API call — you'd pay hundreds of times the price of the thing in fees alone. Cards were built for a human buying a handful of things a day, not a machine buying ten thousand tiny things.

So x402 settles in stablecoins instead (digital dollars — coins pegged one-to-one to a real dollar, so their value doesn't swing around like normal crypto). It moves them on a Layer-2 network (a faster, cheaper lane built on top of a main blockchain) — Base is the popular one. On those rails, sending a tenth of a cent finally makes economic sense.

But there's a deeper problem than fees, and Google named it well. Our entire payment system rests on one assumption: a human is at a trusted screen, clicking "Buy." An autonomous agent breaks that assumption three ways at once. Did the person actually authorise this exact purchase? Is the agent buying what the person really meant? And if it all goes wrong — who is accountable? Cards have no clean answer for a robot spending on your behalf.

The teaching: "Cards assume a person is clicking 'Buy' on a screen they trust. Take the person away and the whole model wobbles — which is exactly the hole agent payments are trying to fill."

The permission slip and the cash register

Here's where most explanations go sideways. They tell you x402 is fighting Visa, or fighting Google, in some winner-takes-all race. It isn't. These pieces sit at different heights, and the interesting ones snap together.

The cleanest way I've found to hold it in my head is to picture a manager handing an assistant a task and some money.

• AP2, Google's protocol, is the permission slip. It's the signed note that says "this agent may buy weather data, up to $50." It proves the agent was authorised and the request is genuine. It doesn't move a penny itself.
• x402 is the cash register. Once the permission exists, it's what actually sends the $0.10 per call. Google even built an extension so AP2 and x402 click together — permission slip, meet cash drawer.
• Visa and Mastercard bring identity and the world's existing checkout. Their agent programmes are about verifying "this is a trusted agent" on the card rails that shops already accept everywhere.
• Stripe brings the spending limit developers love — issue an agent its own virtual card with a hard cap, so it literally cannot spend more than you allow.

None of these is the whole answer on its own. A single agent purchase in 2026 often touches two or three of them at once.

The teaching: "Agent payments aren't one product beating another. They're a permission slip, a cash register, an ID card and a spending limit — and the grown-up systems will quietly use all four."

The number that tells the truth

Now the part I care about most, because it's the part the headlines skip.

In July 2026 the x402 Foundation went live under the Linux Foundation with forty member organisations. Read the list and your eyebrows climb: Visa, Mastercard, American Express, Stripe, Google, Amazon, Cloudflare, Circle. The card networks that crypto usually positions itself against — sitting at the same table. That endorsement is real, and it means something.

Then you look at the money, and a different story appears. x402's own dashboard reported around 75 million transactions moving roughly $24 million in a single month. Impressive — until an on-chain analytics firm called Artemis actually measured it. Their finding: real daily volume was closer to twenty-eight thousand dollars, and about half of all transactions were artificial — wallets paying themselves, or sellers quietly funding their own buyers so the numbers looked alive. They called the boom "still mostly a mirage." Other independent trackers landed in the same neighbourhood: single-digit millions at most, and thinning as the year went on.

For scale, CoinDesk offered the anchor I keep coming back to. Even at its own generous $24 million a month, x402 moves a rounding error next to its own members. Visa alone processes about forty billion dollars — a day.

I don't point this out to dunk on it. I point it out because both things are true at the same time, and that honesty is the whole picture. The plumbing is real, and the blue-chip interest is real. The paying customers, so far, are mostly not.

The teaching: "Endorsement is not adoption. Forty famous logos tell you the idea is taken seriously. Twenty-eight thousand real dollars a day tells you it hasn't arrived yet — and both can be true on the same Tuesday."

So should you care? (yes — carefully)

If you build anything with AI agents, this is the plumbing to watch closely, not the thing to bet the house on.

Watch it, because the shape is right. Machines that can pay per request, in fractions of a cent, with no human in the loop, unlock things that were simply impossible before — an agent buying exactly the data it needs, the moment it needs it, and nothing more. The instant real demand shows up, the rails are already being laid, by people who don't usually agree on anything.

Carefully, because the honest gaps are real. Cards carry decades of chargeback machinery — the "I didn't buy that, give me my money back" safety net. On-chain payments mostly don't, not yet. And handing spending power to an agent that can be fooled by a cleverly worded web page (a prompt-injection attack — sneaking hidden instructions past an AI) is a genuine risk nobody has fully closed. Give a machine a wallet and you've also given it a way to be robbed.

My honest read: x402 is one of the more interesting bets on the board precisely because it's small, open, and built by people laying infrastructure rather than chasing a token. But it is a bet, not a done deal. The right posture is a builder's curiosity, not a buyer's fear of missing out.

The teaching: "Learn the plumbing while it's cheap and quiet. The people who understand how agents pay — before everyone needs to — are the ones who'll build the good things when the money finally arrives."