Everything interesting about x402 follows from one decision made in the 1990s and not revisited until 2025: the web reserved a status code for payment and then never defined what it meant.
Thirty years of an empty code
402 Payment Required sat in the HTTP status table with the note that it was reserved for future use. The web funded itself with advertising and card rails instead. Micropayments were attempted repeatedly and failed on the same obstacle every time: a card transaction has a floor of roughly thirty cents in fees, and no amount of protocol design makes a three-cent API call viable underneath it.
What changed was not the protocol design. It was that a settlement asset arrived which costs a fraction of a cent to move and settles in seconds.
6 May 2025 — Coinbase gives 402 a body
Coinbase Developer Platform published x402 with Erik Reppel, Nemil Dalal and Dan Kim on the byline. The flow is deliberately small:
- The client makes an ordinary
GET. - The server answers
402with its payment requirements — amount, asset, recipient, network. - The client signs a payment authorisation, usually a gasless EIP-3009 USDC transfer on Base.
- A facilitator verifies and settles it.
- The server returns the resource.
No account, no API key, no session. The client can be a program that came into existence four seconds ago. That is the whole point: x402 is an authorisation protocol for parties that have never met and never will.
It is also why x402 alone is not enough. The protocol does not know who paid, only that payment cleared. Identity is a separate problem, which is why ERC-8004 exists and why the join between a payer address and a named agent is a distinct piece of work. The identity half →
23 September 2025 — Cloudflare, and the move to neutrality
Cloudflare wired 402 into its Agents SDK and MCP hosts, and it and Coinbase said publicly that x402 should sit in a foundation. A payment standard owned by one exchange is a feature; the same standard under neutral governance is a rail. The distinction decides whether a competitor can adopt it.
Cloudflare's pay-per-crawl work is the web2 expression of the same idea: a server that can charge a non-human client per request, without either party holding an account with the other.
April and July 2026 — the Linux Foundation
The Linux Foundation took the project in April 2026. The date, 4/02, is not an accident. The foundation went operational on 14 July 2026 with forty members.
The membership list is the part worth reading closely, because it is a payments list rather than a crypto list: Visa, Mastercard, American Express, Stripe, Adyen, AWS, Google, Circle, Cloudflare, Shopify, Solana Foundation, Ripple, Fiserv. Card networks and processors joining a protocol whose premise is that cards cannot price a three-cent call is the strongest available signal that the sub-dollar machine-to-machine segment is considered real — and that nobody intends to let one company own it.
The Linux Foundation now stewards both A2A and x402, so neither Google nor Coinbase owns the handshake or the payment. The handshake half →
Who is who on this rail
| Role | Who | What they actually do |
|---|---|---|
| Author and facilitator | Coinbase | Created the protocol, runs a facilitator, publishes a directory of paid endpoints. |
| Specification owner | Linux Foundation x402 project | Neutral governance from 2026. Forty members. |
| Settlement asset | Circle | USDC. Roughly all of the measurable agent ticket volume is denominated in it. |
| Edge and tooling | Cloudflare | 402 in the Agents SDK and MCP hosts; pay-per-crawl for human-facing content. |
| Indexers | Public x402 explorers | Catalog resources and recipients. Their totals disagree with each other by close to an order of magnitude, which we publish rather than resolve. |
| Sellers | Everyone with an endpoint | A 402 wrapper around an API is a seller, not a new layer. Fine, and not a protocol. |
What the rail looks like when you measure it
Three things are consistently true of the x402 traffic we can see, and all three are unflattering to the headline numbers:
- Tickets are tiny. Median payments sit in cents. This is the segment cards structurally cannot serve, which is the entire economic argument for the protocol — and it means dollar volume will always look small next to any DeFi number.
- The public counters disagree. Two independent x402 indexes report transaction totals that differ by a factor of — right now, because they index different chain sets and different definitions of a transaction. That multiple moves; we publish it live and name the gap instead of picking a winner.
- A large share of visible traffic is testnet. — of x402 transactions we can see are on Base Sepolia rather than Base mainnet. No public x402 headline separates the two. We do.
The live statistics, with definitions and windows →
The honest limit
x402 does not know who paid. It knows a payment cleared from an address. Everything downstream of that — whether the payer is a named agent, an anonymous script, or fifty wallets funded from one source retrying the same endpoint — is an identity question that the payment protocol correctly does not try to answer.
That gap is the reason this site exists, and it is also the reason our own coverage of the rail is small: we can classify only the payers we have already bound to an identity. We publish that fraction rather than implying our sample is the rail. How a payer becomes an identified actor →