AP2 and x402: two answers to how agents pay

Two different problems, both called "agent payments"

"Agent payments" gets used as if it's one problem. It's actually two, and 2026's two leading protocols split cleanly along the line.

AP2 — the Agent Payments Protocol, started at Google — answers: how does a human authorize an agent to spend money without handing it a credit card number and hoping for the best? x402 — built at Coinbase — answers a narrower, more mechanical question: how does one piece of software pay another piece of software for a resource, in-band, over plain HTTP? One is about consent. The other is about settlement. They turn out to compose.

AP2: consent as a signed artifact instead of a dismissed dialog

AP2's core move is to replace "click to confirm" with a chain of cryptographically signed mandates that survive as an audit trail. Per Google Cloud's announcement, the chain has three links:

• Intent Mandate — a signed record of what the user actually asked for. In a live, human-present flow it's the request itself ("find me new white running shoes"); in a delegated flow it's the rules of engagement set up front (a price ceiling, a time window, allowed merchants).
• Cart Mandate — signed once a specific cart is locked in: exact SKU, price, tax, shipping. This is the "what you see is what you pay for" guarantee — the merchant can't swap in a different total after the fact.
• Payment Mandate — the mandate that actually reaches the payment network, linking the authorized amount and funding instrument back to a hash of the matched intent and cart.

The interesting design choice is the split between human-present and human-not-present flows. A live purchase signs the Intent Mandate at request time and the Cart Mandate at approval time — two checkpoints, both with a person in the loop. A delegated purchase ("buy the tickets the instant they go on sale") signs the Intent Mandate once, up front, with hard constraints, and the agent generates the Cart Mandate itself when those constraints are met — no person in the loop at execution time, but a durable, signed record of what they authorized in advance. That's the approval-gate problem, solved as a data structure rather than a UI pattern.

AP2 shipped with 60-plus launch partners spanning card networks (Mastercard, American Express, JCB), processors (Adyen, Worldpay, Checkout.com), and crypto rails (Coinbase, MetaMask, Ethereum Foundation) — a notably wide tent for a protocol this new, per the same Google Cloud post.

In April 2026, Google donated AP2 to the FIDO Alliance, the standards body behind passkeys — a sensible home, since AP2 is fundamentally about proving what a human authorized. FIDO didn't just absorb it: Mastercard contributed its own competing Verifiable Intent framework into the same effort, and FIDO stood up two new working groups to reconcile them — an Agentic Authentication group (chaired by CVS Health, Google, and OpenAI) and a Payments group chaired jointly by Mastercard and Visa, according to FIDO's own announcement. Two rival card networks co-chairing the same working group is a stronger signal than either company's press release alone.

x402: reviving a 30-year-old HTTP status code

x402 solves a different, smaller problem: HTTP status code 402, "Payment Required," has existed since the first HTTP spec and has never been implemented for anything. x402 finally uses it. A server responds to a request with a 402 and payment terms; the requesting agent — human or not — pays in a stablecoin and resubmits the request with proof of payment attached. No account creation, no stored card, no OAuth dance: the payment rides inside the HTTP exchange itself.

Coinbase built it, then handed stewardship to the Linux Foundation, which formed the x402 Foundation on April 2, 2026 and took it fully operational on July 14, 2026 with 40 member organizations — a list that reads like a payments-industry roll call: Visa, Mastercard, American Express, Stripe, AWS, Google, Shopify, Circle, Ripple, and both the Solana and Stellar foundations, per the Linux Foundation's launch announcement. Cloudflare and AWS shipped edge-level 402 support within two weeks of that launch.

The usage numbers are real, not projected, but read them with one big caveat attached. Chainalysis found x402 payments on Base went from near-zero in mid-2025 to over 100 million cumulative transactions by June 2026, climbing further to roughly 169 million total by July 2026. The caveat: a meaningful share of that Q4 2025 surge was a single meme-coin "pay-to-mint" project called PING that required an x402 payment to mint tokens, spiking transaction counts by more than 10,000% in a week at the peak — not organic agent commerce. Strip that out and the more durable signal is the shift in transaction size: payments under a dollar fell to a small minority of volume while $1-plus transactions rose to 95% of it, up from 49% in early 2025, per Chainalysis's analysis. A separate count tied to the Foundation's July 14 launch put roughly 75 million transactions and $24 million moving through x402 in the preceding 30 days — a snapshot, not the cumulative total, but consistent with real, if partly speculative, traffic rather than a whitepaper waiting for a use case.

Where they meet

AP2 and x402 aren't actually competing for the same slot. AP2 is built as extensions to A2A and MCP, and one of those extensions — the A2A x402 extension — exists specifically to let an AP2 Payment Mandate settle over x402's stablecoin rail instead of a card network. In other words: AP2 can decide whether a payment is authorized and what was authorized; x402 can be the rail that actually moves the money once it is. A purchase can carry an AP2-signed consent trail and settle over x402 in the same transaction.

What to watch

Neither protocol is finished. AP2's real test is whether the FIDO working groups actually converge Mastercard's Verifiable Intent into one interoperable spec rather than two "compatible" ones that drift apart — the sort of governance question that decides whether a standard is real or just well-funded. x402's test is whether the shift away from micropayments toward larger transactions holds up as more of its 40 members ship production integrations, or whether it settles into a narrower niche than the "agents paying agents by the cent" pitch implied.

Both are early enough that betting the architecture on either is premature, but neither reads as vaporware anymore — there's a signed-mandate spec with 60-plus partners and a settlement rail clearing real transaction volume, and they're built to plug into each other rather than to fight over the same socket. Current status and sourcing for both live on the tracker.