What Is x402? How HTTP 402 Payment Required Powers AI Agent Micropayments on Base

HTTP has had a 402 Payment Required status code sitting unused in the spec since 1997 — reserved for future use, never standardized. x402 is the protocol that finally gives it a job: an open standard from Coinbase and Cloudflare that turns a 402 response into a machine-readable payment challenge, settled in USDC on Base in the time it takes to complete an HTTP round trip. No API keys, no subscriptions, no human in the loop — just a request, a price, and a payment.

This post covers how the protocol actually works, what a compliant 402 response looks like field by field, who verifies payments, and the mistakes that break it in practice.

Why This Exists

Two problems have made per-request API monetization impractical for years: card payments carry fixed fees that make sub-cent pricing uneconomical, and every new integration needs a signup, an API key, and a billing relationship before a single request goes through. Neither problem is tolerable for AI agents that need to discover and pay for a service autonomously, mid-task, without a human clicking "subscribe."

x402 solves both by moving settlement onto a stablecoin rail with near-zero fees and by making the payment negotiation part of the HTTP exchange itself. An agent (or a browser, or a script) doesn't need to know in advance that an endpoint charges money — it finds out from the response, and can act on that information immediately.

How the Flow Works

1. A client requests a resource normally — GET or POST, no special headers.
2. If the resource is paywalled, the server responds 402 Payment Required with a JSON body describing exactly how to pay: which network, which asset, how much, and where to send it.
3. The client constructs a signed payment authorization (an EIP-3009 transferWithAuthorization for USDC on EVM chains) and resubmits the original request with an X-PAYMENT header carrying the proof.
4. A facilitator — a third-party service, not the resource server itself — verifies the payment is valid and settles it on-chain.
5. The server checks the facilitator's verification result and, if it's good, serves the resource.

No wallet popup, no redirect, no OAuth dance. The entire negotiation fits inside two HTTP requests.

The Payment Challenge, Field by Field

Here's a real 402 response — this is what ContextIQ's own x402-gated DNS Inspector API returns to an unauthenticated caller:

{
  "x402Version": 1,
  "accepts": [{
    "scheme": "exact",
    "network": "base-sepolia",
    "maxAmountRequired": "10000",
    "resource": "https://contextiq.trango-compute.com/api/v1/dns-inspector",
    "description": "DNS Inspector record lookup — per call",
    "mimeType": "*/*",
    "payTo": "0x...",
    "maxTimeoutSeconds": 300,
    "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
    "extra": { "name": "USDC", "version": "2" }
  }],
  "error": "Payment required"
}

Field	What it means
x402Version	The spec revision the server implements (currently 1)
scheme	The payment mechanism — exact (pay this precise amount) is the only scheme in wide use today
network	The chain identifier — base, base-sepolia, polygon, arbitrum, world, solana, or stellar
maxAmountRequired	The price, in the asset's atomic units — "10000" is $0.01 at USDC's 6 decimals, not $10,000
resource	The exact URL this price applies to
payTo	The address that receives the payment
asset	The token contract (or mint) address — almost always USDC today
maxTimeoutSeconds	How long the client has to complete payment before the challenge expires
extra	Scheme-specific data — for exact on EVM chains, the EIP-712 domain name/version the client needs to sign correctly

That maxAmountRequired unit mistake — treating an atomic-units string as a decimal dollar amount — is one of the most common integration bugs, and it's silent until someone tries to actually pay.

One More Thing: The Shape Isn't Fixed

The table above is x402Version: 1, which is what Coinbase's CDP facilitator and most seller middleware — including ContextIQ's own — currently emit. Live x402Version: 2 implementations already exist with a meaningfully different field layout — CAIP-2 network identifiers, a renamed amount field, and fields relocated into extra. If you're building anything that reads 402 responses yourself rather than relying on a maintained client library, the differences are worth understanding in detail — see x402 v1 vs v2: What Changed in the Payment Requirements Schema.

Facilitators: Who Actually Verifies the Money Moved

The server that serves your content and the service that verifies payment don't have to be the same thing — and in practice, they rarely are. Coinbase's CDP facilitator covers the EVM side (Base, Polygon, Arbitrum, World Chain) plus Solana, and the Stellar Development Foundation shipped a production facilitator for its own chain in 2026. This separation is what makes x402 practical for a small API operator: you don't need to run blockchain infrastructure yourself, you configure a facilitator and it handles verification and settlement on your behalf.

Who Governs the Spec

x402 isn't a Coinbase-only project anymore. It's now stewarded by the x402 Foundation, operating under the Linux Foundation, with premier members including AWS, Google, Visa, Circle, Cloudflare, Coinbase, Mastercard, Stripe, and the Stellar Development Foundation, among roughly forty organizations total. Adoption isn't theoretical, either — by mid-2026 the network had processed well over a hundred million transactions across tens of thousands of active agents, and Coinbase launched a directory of x402-paywalled services for agents to discover and pay for programmatically.

Where x402 Breaks in Practice

Every failure mode below is something a client can observe from the outside, which is exactly why it's worth checking before you assume an integration works:

• Missing payTo. If the server's wallet address configuration is unset, some implementations silently emit a 402 body with no payTo field at all — a client has no idea where to send money, and the integration fails the first time someone actually tries to pay, not before.
• Amount unit confusion. Passing a dollar amount ("0.25") where the field expects atomic units ("250000") either overcharges by orders of magnitude or fails validation entirely, depending on the client's own error handling.
• Method mismatches. x402 commonly protects POST endpoints, and a client (or a checker) that only tries GET will see a 404 or 405 and wrongly conclude the endpoint doesn't support x402 at all.
• Network typos. A network value that doesn't match any facilitator's supported list means no facilitator will ever verify a payment against it, no matter how correct the rest of the challenge looks.

Every one of these is a shape problem, not a blockchain problem — and every one is visible in the 402 response itself, before a single dollar moves.

Check Your Own Integration

If you're exposing an x402-gated endpoint — or paying one from an agent — the x402 Inspector validates the payment challenge end to end: response shape, network and address formats per chain, amount encoding, and spec-version detection, with a plain-language explanation for anything that doesn't match the spec. It's a shape check, not a live transaction — nothing it does ever spends real funds, so it's safe to point at a production endpoint.

x402 is the payment half of what's becoming the standard stack for autonomous agent commerce. The identity half — proving who you're paying before you send the money — is a separate, newer standard called ERC-8004, and it's worth understanding both before you wire an agent up to pay anyone automatically.