x402 vs MPP vs AP2 vs ACP vs Card Networks: Choosing How AI Agents Pay
Six ways for AI agents to pay were live or in draft in October 2026: x402 and MPP charge per request, ACP and UCP run checkout inside AI assistants, AP2 records what a user approved, and Visa and Mastercard give agents scoped card credentials. For each agentic payment protocol, this guide covers what it settles on, where spending limits live and whether anyone runs it in production.
Reviewed by Luis Medeiros, Field CTO at Protofire · Updated October 2026
Use x402 to charge agents per API call. It has the broadest facilitator support and settles almost entirely in USDC. Add MPP, from Stripe and Tempo, on the same endpoint if you also want cards or session billing. To sell goods inside Copilot or Gemini, or to be found in ChatGPT's shopping results, reach ACP and UCP through your payment provider. You stay merchant of record. Add AP2 mandates for signed proof of what a user approved, though no production deployment is confirmed. Card issuers can give agents scoped credentials through Visa and Mastercard, and the cardholder stays responsible. x402 itself sets no budget, so an agent's limits have to live in its wallet. Agent payment volume is still small.
Our own work sits on the onchain side of this comparison: Protofire builds agent wallets, smart accounts with spending limits and stablecoin settlement. We run no facilitator and are not a member of the x402 Foundation, and the card network section below says where cards are the better rail. Facts were checked against primary sources on 18 October 2026. Related decision guides compare stablecoin models, for the dollar most agent payments settle in, and custody models, for who holds an agent's keys.
Agentic payment protocols compared
6 options side by side: scroll the table sideways to see all of them.
The six options, layer by layer
x402
- +Foundation governance: a Linux Foundation project whose technical steering committee seats Coinbase, Cloudflare and Stripe, with Visa, Mastercard and American Express among its members
- +No accounts or API keys: the server answers 402, the client signs a transfer authorization, and a facilitator verifies and settles it onchain
- +Live through Coinbase's CDP facilitator (Base, Polygon, Arbitrum, Monad, World, Solana) and Stripe's machine payments (Base, in Stripe's Frontier release phase)
- +Four schemes in v2 (exact, upto, batch-settlement, auth-capture) cover fixed prices, metered usage, batching and refundable holds
- −The spec puts budget management and sessions out of scope, so every spending limit has to live in the agent's wallet, SDK or platform
- −A stablecoin rail in practice (99.6% of settled value is USDC, per TRM Labs, September 2026) with no chargeback, so refunds must be designed in
- −Screening depends on the facilitator: the protocol has none, while Coinbase's facilitator runs OFAC and KYT checks
- −Real agent commerce is a thin slice of the traffic: TRM Labs put the agentic share of screened x402 value at 0.6% to 7.5% in September 2026
x402 puts the long-reserved HTTP 402 "Payment Required" status to work. A server answers a request with the price and payee, the client signs a transfer authorization with that amount and recipient inside it (EIP-3009 or Permit2 for ERC-20 tokens on EVM chains, an ERC-7710 delegation from a smart account, or an SPL transfer on Solana), and a facilitator verifies the signature and settles onchain, so it cannot redirect the funds. Coinbase launched the protocol in May 2025 and contributed it to the Linux Foundation, which announced the x402 Foundation in April 2026 and declared it operational on 14 July 2026 with 40 members. The canonical code now lives in the x402-foundation organization on GitHub, where the steering committee file lists one seat each for Coinbase, Cloudflare and Stripe.
The v2 specification (December 2025) added standard network identifiers (CAIP-2) and an extensions object, and the repository now holds four payment schemes: exact, upto (authorize a maximum, settle actual usage), batch-settlement (which folded in the earlier deferred-payment proposals, Cloudflare's 2025 one among them) and auth-capture (hold, capture, void and refund).
The v2 specification lists "client-side budget management" and "session handling mechanisms" as out of scope. So when you give an agent a wallet, the protocol checks that each signed payment is valid, and the wallet or platform decides how much the agent may spend. Coinbase's CDP facilitator settles on Base, Polygon, Arbitrum, Monad, World and Solana, runs OFAC and KYT checks that decline payments involving sanctioned or high-risk addresses, and charges $0.001 per onchain transaction after the first 1,000 each month.
The volume is small, and raw transaction counts overstate it, because they include the wash and test activity that Visa and Artemis exclude from their adjusted count. In September 2026, TRM Labs reported about $52.7 million settled through known facilitators on Base, Solana and Polygon since May 2025 and estimated that between 0.6% and 7.5% of screened commerce looks agentic.
MPP (Machine Payments Protocol)
- +Method-agnostic: one challenge can be paid in Tempo or Solana stablecoins, by card through Stripe's Shared Payment Tokens, or over Lightning
- +Sessions support metered, pay-as-you-go billing in sub-cent increments
- +Built to sit beside x402: the mppx library serves MPP and x402 clients from the same endpoint
- +Open terms: the specs are CC0 and the SDKs Apache-2.0 or MIT
- −Young: launched on 18 March 2026, and its core is an IETF individual Internet-Draft, not a working-group standard
- −Small so far: about $25,000 across roughly 115,000 transactions in its first weeks, to 21 April 2026, per Visa and Artemis
- −Its two authors, Tempo Labs and Stripe, maintain it directly rather than through a neutral foundation
- −On Stripe, stablecoin acceptance excludes New York businesses and is by request outside the US
Stripe and Tempo launched the Machine Payments Protocol on 18 March 2026 as an open standard for agents to pay, accepting stablecoins as well as cards and buy-now-pay-later methods through Shared Payment Tokens. MPP is an HTTP authentication scheme, defined in the individual Internet-Draft draft-httpauth-payment-01 (September 2026): the server sends a WWW-Authenticate: Payment challenge, the client answers with an Authorization: Payment credential for the method it chose, and the server returns a receipt. MPP's companion specs define intents for a one-off charge, a subscription and a session, in which the agent deposits funds upfront and then pays as it goes, which suits metered billing such as per-token inference. No IETF working group has adopted the draft yet.
MPP's own docs call it complementary to x402 and show one route serving both, so most sellers do not have to pick a side. With Stripe's machine payments, which Stripe labels Frontier (its release phase for fast-changing APIs, where breaking changes are more likely), payments from either protocol land in the seller's Stripe balance and settle in fiat, refunds run through the normal Refunds API, and the floors are 0.01 USDC for stablecoins and 0.50 USD for cards through Shared Payment Tokens. Stripe takes MPP stablecoins on Tempo (USDC.e) and Solana (USDC), and x402 on Base (USDC). Visa and Artemis counted about $25,000 of MPP settlement across roughly 115,000 transactions in its first weeks, to 21 April 2026, and we found no later independent count.
ACP (Agentic Commerce Protocol)
- +The business stays merchant of record (the party that sells, takes the payment and handles refunds and disputes), and payments, settlement and compliance stay on its existing payment rails
- +Delegated payment tokens are bounded by an allowance: maximum amount, currency, merchant and expiry
- +Wide scope by 2026: checkout, product feeds, cart, orders, delegated authentication and an MCP binding
- +Live distribution: Microsoft's Copilot Checkout reaches sellers through ACP via Stripe
- −ChatGPT Instant Checkout, the surface ACP launched on, was wound down in March 2026
- −Still labelled beta, with a breaking spec revision in December 2025
- −OpenAI and Stripe appoint the steering committee and keep a last-resort veto, though Meta now holds a seat
- −Cards and wallets in practice: there is no stablecoin rail
The Agentic Commerce Protocol shipped in September 2025 alongside ChatGPT's Instant Checkout. The ACP repository (Apache-2.0, contributor agreement required) says it is maintained by OpenAI and Stripe "and is currently in beta", and that it lets agents transact "without being the merchant of record". Its Delegate Payment API issues a token that works only inside an allowance (max_amount, currency, merchant_id, expires_at), while payments, settlement and compliance stay on the merchant's rails. Spec versions run from 2025-09-29 to 2026-04-17, the latest stable release, and the scope has grown to product feeds, cart, orders, delegated authentication, discovery and an MCP binding. Under its governance file, OpenAI and Stripe appoint the steering committee and hold a last-resort veto; Meta joined the committee on 24 April 2026.
OpenAI wound down that launch surface within six months. In March 2026 it said the first Instant Checkout "did not offer the level of flexibility that we aspire to provide", and moved to letting merchants use their own checkout while it concentrates on product discovery. ACP carries on underneath: Microsoft's Copilot Checkout uses it, with Stripe connecting to the seller through a Shared Payment Token. For a merchant, the practical route is a payment provider that already speaks ACP, so the integration lands in the checkout and dispute stack you run today.
UCP (Universal Commerce Protocol)
- +Covers the whole shopping lifecycle: catalog, cart, checkout, identity linking, orders and payment handlers
- +Retailers remain the seller of record, and checkout runs through payment handlers such as Google Pay
- +Co-developed with Shopify, Etsy, Wayfair, Target and Walmart, and endorsed at launch by Adyen, American Express, Mastercard, Stripe and Visa
- +Ships often on date-based releases: v2026-08-25 added 3DS2, split payments and payment schedules
- −No native stablecoin or x402 payment handler in the core spec
- −Checkout started with eligible US retailers, in Google's own AI Mode and Gemini
- −Google co-founded it and operates the main surfaces that use it today, AI Mode and Gemini
- −It competes with ACP, so a merchant who wants reach across assistants ends up supporting both
Google announced the Universal Commerce Protocol on 11 January 2026, co-developed with Shopify, Etsy, Wayfair, Target and Walmart and endorsed by more than 20 companies, including Adyen, American Express, Mastercard, Stripe and Visa. Checkout runs in AI Mode in Search and in the Gemini app, starting with eligible US retailers, with Google Pay at launch and PayPal named as the next payment option, and Google states that "retailers remain the seller of record". Where ACP centres on checkout, UCP covers the full lifecycle: catalog, cart, checkout, OAuth 2.0 identity linking, orders and payment handlers.
The spec ships date-based releases: v2026-04-08 added cart, catalog search, request signing and OAuth 2.0 identity linking, and v2026-08-25 added 3DS2, split payments across instruments and payment schedules for deposits and installments. The core spec has no stablecoin or x402 payment handler, so UCP is a card and wallet path today. AP2 is designed to work inside it as the consent layer for purchases an agent makes on its own. The maintainers file lists a Governance Council of Google, Shopify and Stripe with two seats open, and the project's governance rules make the Google and Shopify seats permanent. Because UCP and ACP compete for the same merchants, a seller who wants reach across assistants is better served by one payment provider that handles both than by two direct integrations.
AP2 (Agent Payments Protocol)
- +Evidence of consent: the user signs a mandate on a non-agentic trusted surface, so a dispute has a record of what was authorized
- +Open mandates encode constraints the agent cannot exceed, and each closed mandate binds one exact checkout and payment
- +A neutral home: Google donated AP2 to the FIDO Alliance on 28 April 2026
- +Instrument-agnostic, and designed to be compatible with UCP
- −No confirmed production deployment found as of October 2026
- −Version 0.2.0 after only two releases, and v0.2 replaced the earlier mandate model
- −Defines no checkout, catalog or settlement of its own: it needs UCP or another commerce protocol around it
- −The repository still sits in Google's GitHub organization while the FIDO work gets under way
Google introduced the Agent Payments Protocol in September 2025 and donated it to the FIDO Alliance on 28 April 2026, the day v0.2.0 shipped with a focus on flows where the human is not present. Google's announcement also points to Verifiable Intent, which it co-developed with Mastercard and which is compatible with AP2. The v0.2 specification says AP2 "operates as a security feature within a Commerce Protocol" and leaves commerce operations out of its scope.
AP2 has two mandate types, Checkout Mandate and Payment Mandate, each either open (constraints the user approved) or closed (one exact transaction), carried as SD-JWTs (signed tokens that can disclose selected fields). When the user is present, the user signs closed mandates on a trusted surface. When the agent acts alone, the user signs open mandates and the agent signs closed mandates inside those limits, and verifiers receive the closed mandates together with the open-mandate constraints that apply to them.
AP2 is the option in this comparison built to produce dispute evidence: a signed open mandate records what the user agreed the agent could buy and pay. It moves no money and leaves the merchant of record unchanged. It is also young: we found no public, confirmed production AP2 transaction as of 18 October 2026, and the protocol is two releases old. Use it where provable consent matters more than live volume, and expect the format to keep changing under FIDO.
Card network agent programs
- +Works at merchants that already take cards online (the Visa Rules bar agentic transactions in a card-present environment), with chargebacks and existing fraud tooling intact
- +The user approves the agent's payment instruction with a passkey, and the network checks each request against it
- +Agent recognition at the merchant edge: Visa's Trusted Agent Protocol and Agent Directory, and Mastercard's requirement that agents be registered and verified
- +Live consumer transactions: Visa reported agentic payments across Europe with more than 30 issuers in July 2026
- −Proprietary: under the Visa Rules, agentic payment providers must enroll in Visa Intelligent Commerce and register with Visa
- −The cardholder carries the agent's actions: the Visa Rules treat them as if the cardholder had initiated the transaction, and neither network has published an agent-specific liability shift
- −Fiat settlement with card economics, so sub-cent per-request pricing does not fit (Stripe's card floor is 0.50 USD)
- −No published volumes from either network for agent transactions
In Visa Intelligent Commerce, the user adds a Visa card to an agent, authenticates a payment instruction with a passkey, and Visa validates that each later request for credentials matches that instruction, with network controls that check the request comes from the intended merchant for the correct amount. The Visa Rules (18 April 2026 edition) now name the roles: a cardholder "is responsible for any actions taken by an Agentic Payment Provider as part of an Agentic Transaction as if the Cardholder initiated the Transaction", initiators of agentic transactions "are not considered Merchants", an agentic payment provider must make an order confirmation available to the cardholder for at least 120 days, and a merchant must not make a cardholder waive the right to dispute an agentic transaction.
On 2 July 2026 Visa reported live agentic purchases across Europe with more than 30 issuers, authenticated with Visa Payment Passkeys, with its Trusted Agent Protocol and Agent Directory letting merchants recognize verified agents. It gave no volumes.
Mastercard Agent Pay, announced on 29 April 2025, issues Mastercard Agentic Tokens built on its existing tokenization, requires AI agents to be "registered and verified" before they can pay on a user's behalf, and promises consumers control over what the agent is allowed to buy. In June 2026 Mastercard added Agent Pay for Machines, with authorization rules and spending limits that are "programmatically enforced" and settlement across cards, accounts and stablecoins, with launch partners pointing to MPP compatibility and x402. For a bank, wallet or fintech that already issues credentials, these programs are the shortest path to letting agents spend. For a seller of API calls priced in fractions of a cent, card economics do not work.
Where agents can pay today
Deployments confirmed from the operator's own documentation or announcement on 18 October 2026, using the sources cited in each section above. Protocol support and production support are different things, so check the operator's current docs before you build on any row. None of these operators publishes agent-only volumes; the closest cross-protocol count is Visa and Artemis's x402 and MPP figures.
Which agentic payment protocol should you use?
you sell an API, a dataset, inference or content per request: start with x402 for the broadest facilitator and wallet support, and add MPP on the same endpoint if you also want card payments or session billing.
you are a merchant who wants to be bought from in Copilot, ChatGPT discovery or Google AI Mode: reach both protocols through a payment provider that speaks them, and keep your merchant-of-record position and card dispute rights.
your agent pays for tools and data: give it a smart account or MPC wallet whose limits are enforced at signing or onchain, because x402 leaves budgets to the wallet. If the agent mostly buys from ordinary online shops, a card credential through Visa Intelligent Commerce or Mastercard Agent Pay reaches more sellers, since online merchants already take cards.
your agent buys while the user is away and you need signed evidence of what the user approved, and you can work with a v0.2 protocol that has no confirmed production use.
you issue cards or hold customer credentials: Visa Intelligent Commerce and Mastercard Agent Pay let you give agents scoped credentials under card rules your customers already rely on, after enrolling in each network's program.
per-call prices sit below a cent: settle in batches with x402's batch-settlement scheme or MPP sessions rather than one onchain transfer per call, and check your provider's minimum settlement first.
Adjacent rails, identity and discovery
- Lightning L402: Lightning Labs' L402 pairs HTTP 402 with a Lightning invoice and a macaroon, for Bitcoin-native sellers, and publishes no usage figures. The two larger protocols now reach Lightning as well: MPP lists Lightning among its payment methods, and x402 added a Lightning variant of its exact scheme in September 2026.
- Know-your-agent signals: Skyfire's KYAPay, published as an IETF individual draft rather than a standard, defines signed tokens that carry an agent's identity, a payment credential, or both. Inside the card programs, Visa's Agent Directory and Mastercard's agent registration do the same job. On Ethereum, ERC-8004, still a Draft, defines identity, reputation and validation registries for agents and leaves payments out of its scope.
- Discovery: x402 has a discovery extension called Bazaar, and Stripe lists machine-payment integrations in its Directory after asking sellers for an llms.txt file and example prompts.
- Stripe's card path for agents: Shared Payment Tokens are scoped grants that let an agent use a customer's card or buy-now-pay-later method through a seller's Stripe profile, each with usage and expiration limits. They carry no stablecoins; Stripe routes stablecoin payments from agents through MPP and x402 instead.
FAQ
What are agentic payment protocols?
What is x402?
Is x402 owned by Coinbase?
What is the difference between x402 and MPP?
What is the difference between x402 and AP2?
Who is liable when an AI agent pays?
Do stablecoins or cards work better for AI agents?
Does x402 set spending limits for AI agents?
What happened to ChatGPT Instant Checkout?
How much money do AI agents actually move?
Is AP2 live, and who runs it now?
Discussed on The Protocol Roundtable
All episodes
What know your agent means for onchain lending
Gareth Christian-Lim, Midnight FoundationMoment at 1:00:10Episode 3 · Credit Markets on Demand
Whether stablecoins will replace cards in the next five years
Pooja Shah, RainMoment at 30:11Episode 6 · Stablecoins Go Mainstream: Inside the New Payments Stack
We build agent wallets with limits enforced at signing or onchain, x402 and MPP paywalls, merchant checkout through ACP and UCP, and stablecoin settlement reconciled into your ledger with a refund path.
Agentic payment integration →Get a proposal
Tell us what you are building. An engineer reads it, we have a short call, and the written proposal follows within one business day.
Budget
An NDA is available from the first message and can cover anything you share. How it works