What know your agent means for onchain lending
Gareth Christian-Lim, Midnight Foundation
Moment at 1:00:10Episode 3 · Credit Markets on Demand
Agentic Payments Development and x402 Integration
In short
For an agent that pays, we build the wallet, the limits it cannot override and the client that answers payment requests. For an API, store or platform that agents pay, we build the x402 or MPP paywall or the ACP or UCP checkout. Settlement, reconciliation, screening, refunds and monitoring come with either side. Agent payment volume is still small, so a first build covers one flow you can measure.
Reviewed by Luis Medeiros, Field CTO at ProtofireLast reviewed: October 2026
250+
projects shipped since 2016
$2B+
secured on Safe across 120+ EVM networks
60+
networks integrated
1M+
developers use Solhint, which we maintain
Trusted by teams building on-chain
Agentic payments are payments an AI agent makes or receives on someone's behalf: an agent paying an API per call, a shopping assistant checking out inside Copilot or Gemini, a service billing other machines by the request. Protofire builds agentic payment integrations on both sides of that transaction: agents that pay within limits you set, and APIs, merchants and platforms that get paid by agents.
For each flow we pick the protocol that fits: x402 or MPP when an agent pays per request, ACP or UCP when it checks out inside an AI assistant, AP2 mandates when you need proof of what the user approved, and the Visa and Mastercard agent programs when it pays by card. Our comparison of agentic payment protocols sets out how they differ.
The x402 v2 specification lists "client-side budget management" as out of scope, so an agent's caps across many payments belong in its wallet. Under the Visa Rules, the cardholder answers for an agent's purchase as if they had made it.
A stablecoin payment has no chargeback, so refunds need their own path. We build those parts for the protocol you choose, starting with the smart account or wallet that holds the agent's limits.
Seven layers from consent to ledger
Every agent payment crosses these layers, from the authority a person grants the agent to the ledger entry that records the payment. Protofire can build one of them or all seven, and run monitoring and operations after launch.
01
Authority and consent
The budget, payees and expiry a person or business grants the agent, captured as a signed mandate or a passkey-approved payment instruction where the protocol supports one.
02
Agent wallet and policy
A smart account or MPC wallet holding the agent's funds or credentials, with spending caps, allowlists and expiry enforced at signing or onchain.
03
Agent identity
Signed agent requests, card-network agent registration or an onchain identity, so a seller can tell an approved agent from a bot.
04
Payment protocol
x402 or MPP for pay-per-request, ACP or UCP for checkout inside AI assistants, card-network agent credentials where the user pays by card.
05
Facilitator or payment provider
The service that verifies and settles each payment: an x402 facilitator such as Coinbase's or Circle's, or a payment provider such as Stripe.
06
Settlement and reconciliation
Stablecoin or card settlement mapped to the order, API call or invoice it pays for, in your existing ledger.
07
Compliance and operations
Sanctions screening, Travel Rule data, refunds and disputes, monitoring, alerts and a kill switch.
01
What we build
x402 sets no budget of its own, so the agent's limits go where the agent cannot change them. The plainest form is an allowance: the agent may spend a set amount of one token, and the allowance resets on an interval. Safe's Allowance Module works this way for a Safe, and Coinbase's Spend Permissions for a Coinbase smart account.
Around the allowance we add caps per payee, allowlists and an expiry, so the agent pays only the services you approved, until a date you set.
Both are smart accounts, contract wallets whose rules run onchain. The same limits can run as session keys or delegated permissions on ERC-4337 accounts (Final since June 2026, EntryPoint v0.9), on existing addresses given smart-account features through EIP-7702, or through ERC-7710 and ERC-7715 delegations (both still Drafts, as in MetaMask's Smart Accounts Kit).
Where keys should not sit in a contract, we integrate MPC, enclave and embedded agent wallets and set the policy they check before signing: Circle's Agent Wallets (2-of-2 MPC with caps over a rolling window), Coinbase's Agentic Wallet, Turnkey's enclave policy engine, Privy or Fireblocks. The wider practice sits in our account abstraction and wallet development work.
If you sell an API, data, inference or content, we add a payment step an agent can complete without an account or an API key. x402 is governed by the x402 Foundation, which the Linux Foundation declared operational on 14 July 2026, and its v2 HTTP transport carries a payment in three messages:
1. Your server answers an unpaid request with HTTP 402 and a PAYMENT-REQUIRED header whose accepts list gives the scheme, network, amount, asset and payTo, the address that receives the payment.
2. The agent signs an authorization for that amount and payee, then retries the same request with the signed payload in a PAYMENT-SIGNATURE header.
3. A facilitator (the service that checks the signature and submits the payment onchain) settles it, and your server returns 200 with the resource and a PAYMENT-RESPONSE header holding the settlement result and the onchain transaction hash.
We pick the facilitator for your rails: Coinbase's CDP facilitator, Circle's, Fireblocks' white-label facilitator for payment providers, or Stripe, which settles to your Stripe balance in fiat. The mppx library serves MPP and x402 clients from one endpoint, so cards and stablecoins can share a route.
For sub-cent prices we batch settlement (x402's batch-settlement scheme, Circle's Nanopayments or MPP sessions) and plan around each provider's floor: on Stripe, 0.01 USDC for stablecoins and 0.50 USD for cards.
If you build agents, we make them able to pay. The client reads the price in the 402 response, checks it against the agent's limits, signs an authorization for that amount and payee, resends the request and stores the settlement result. The signature format follows the chain and the account: EIP-3009 or Permit2 for ERC-20 tokens on EVM chains, an ERC-7710 delegation from a smart account, or an SPL transfer on Solana.
x402 defines transports for HTTP, MCP and agent-to-agent (A2A) calls, so the same client works inside MCP tool calls and between agents, and we can run it on Amazon Bedrock AgentCore Payments, which supports x402 and MPP with wallets from Coinbase and Stripe's Privy. Every payment is logged with the request that triggered it, so a person can audit what the agent bought and why.
If you sell goods or subscriptions, we connect your catalog and checkout to the AI assistants your customers shop in. We integrate the feeds, checkout endpoints and delegated payment tokens through the payment provider you already use, such as Stripe's Agentic Commerce Suite, PayPal Agent Ready, Adyen or Checkout.com, so you stay merchant of record and keep your dispute process.
Where an agent buys without the shopper present, we add AP2 mandates or Mastercard's Verifiable Intent so you hold signed evidence of what was approved. Where you accept cards, we wire in Visa Intelligent Commerce and Mastercard Agent Pay, including agent recognition through Visa's Trusted Agent Protocol and Web Bot Auth verification of Mastercard Agent Pay agents at the CDN.
Agent payments still have to land in your books. On stablecoin rails we settle in USDC, which carried 99.6% of x402 value according to a September 2026 analysis by TRM Labs, or another stablecoin you hold, such as OUSD, the default stablecoin on Stripe since 30 September 2026, and convert to fiat through Stripe or a ramp where you need it.
We map every settlement to the order, API call or invoice it pays for, using x402's payment-identifier and receipt extensions and the indexing practice we built on The Graph, so finance sees each agent payment as a ledger entry tied to its order. When value moves between chains we use Circle's CCTP for native USDC or Chainlink CCIP. Our crypto payments work covers the wider rails.
02
The controls around every agent payment
Whichever protocol carries the payment, these are the controls we design and build into the integration.
01
Spending limits that hold
Caps per payment, per day and per payee, token and network allowlists, and expiry, enforced in the smart account or at signing. Coinbase's own documentation says an instruction to the agent "is not a server-enforced session spending limit", and its CDP SDK keeps its default spend ledger in memory, so we put limits where a restart or a prompt cannot reset them. Ran Wei of Pharos Network described the gap on The Protocol Roundtable: "We need to redesign all these policies and execution rules according to what the agent needs, and how much authority we should authorize them to do."
02
Payer of record and liability
The person or business that delegated authority is the payer, under every framework we checked. The Visa Rules make a cardholder responsible for an agent's actions "as if the Cardholder initiated the Transaction", and in the US, for debit and bank-account payments, Regulation E does not treat a transfer as unauthorized when the consumer gave the access device to the person who made it, until the consumer tells the financial institution that transfers by that person are no longer authorized. We design the consent capture (signed mandates, passkey-approved instructions) and, where you act as the agentic payment provider, make order confirmations available to the cardholder for the 120 days the Visa Rules require.
03
Refunds and disputes
A stablecoin transfer has no chargeback, so a refund path has to exist before launch: x402's auth-capture scheme (hold, capture, void, refund), Coinbase Payment Acceptance's authorize, capture and refund flow, an escrow contract modelled on Circle's open-source Refund Protocol (an unaudited reference design, not a product), or a card leg where chargebacks already apply. Visa also forbids merchants from making cardholders waive their dispute rights on agentic transactions.
04
Screening and the Travel Rule
Sanctions screening and KYT (monitoring where funds come from and go) at the facilitator or the wallet (Coinbase's facilitator and Circle's Agent Wallets both screen), plus Travel Rule data where it applies. Under the EU Transfer of Funds Regulation there is no low-value exemption for crypto transfers, and above EUR 1,000 to or from a self-hosted wallet, one no provider controls, the provider must assess ownership or control (Articles 14(5) and 16(2)); the US rule applies at $3,000 or more, and FATF lets countries set a de minimis threshold of up to USD or EUR 1,000. Batching cuts the number of onchain transfers, but the regulated provider's data duties stay the same. We build these hooks into your existing stack through compliance integration.
05
Agent identity and know-your-agent
Sellers need to tell an approved agent from a bot, and the card networks now require agents to register. We implement signed agent requests (HTTP Message Signatures as used by Web Bot Auth, now an IETF working-group draft, and by Visa's Trusted Agent Protocol), card-network agent registration, and onchain identity through ERC-8004, a Draft standard whose identity registry has been live on Ethereum mainnet since 29 January 2026. Gareth Christian-Lim of the Midnight Foundation said on The Protocol Roundtable: "You have KYC and KYB and AML checks. We've got KYA, which is know your agents."
06
Monitoring and a kill switch
Spend dashboards, anomaly alerts, a log that ties every payment to the agent action behind it, and a kill switch that revokes a session key or pauses a module in one step. Reuters reported in October 2026, citing people familiar with the matter, that the OCC, FDIC and Federal Reserve are asking banks what limits their AI agents run under, how their actions are monitored, approved and audited, and how the systems can be shut down. We can run this around the clock through managed onchain operations, with the guardrails, logging and human approval gates of our AI automation work.
03
What are agentic payments?
Agentic payments are payments an AI agent initiates for a person or business that authorized it, and that person or business stays the legal payer. They run over pay-per-request protocols (x402 and MPP), checkout protocols inside AI assistants (ACP and UCP, with AP2 mandates as proof of consent) and the card networks' agent programs.
04
How much agent payment volume exists today?
Visa and Artemis counted about $15.0 million in adjusted x402 volume across 109.6 million transactions up to 21 April 2026, after excluding identified wash and test activity, and about $25,000 for MPP in its first weeks. TRM Labs estimated in September 2026 that between 0.6% and 7.5% of screened x402 value is agentic, and Visa's chief executive described agentic commerce as being in "very early stages" in July 2026.
Several of the rails are live or in beta: Coinbase and Circle settle x402 on mainnet, Stripe accepts it in its Frontier release phase, Amazon Bedrock AgentCore Payments lets agents pay x402 and MPP endpoints, Cloudflare runs x402 in a closed beta, and Visa reports live agent purchases in Europe with more than 30 issuers. At this volume, a first integration should be narrow enough to measure: one paid API, or one agent paying for its tools.
05
How an engagement works
Luis Medeiros, our Field CTO, said on The Protocol Roundtable: "In the short term, we're not prepared yet to hand over the keys to the agents end to end, right?" The Launch phase below is built on that view.
1
Design
We map who pays whom (agent to API, agent to merchant, machine to machine), pick the protocol and rail for each flow, decide where keys and limits live, and settle the compliance perimeter with your counsel: who is payer of record, which screening and Travel Rule duties apply, and whether a licensed partner is needed. Deliverable: the protocol for each flow, where each key sits, a limits and liability design (caps, consent capture, refund path and payer of record), and a build plan.
2
Build
We build the pieces the design calls for, from the wallet policy to the refund flow, and harden every contract before an external audit. Deliverable: a working integration on testnet, then on mainnet.
3
Launch
A supervised rollout with low caps, human approval above a threshold and every payment logged, then higher limits as the logs justify them. Deliverable: agents paying, or getting paid, in production.
4
Operate
Optional 24/7 monitoring, alerting, incident response and protocol upgrades as x402, MPP, ACP, UCP and AP2 keep shipping new versions. Deliverable: a payment layer we run for you, or one your team runs from our runbooks. If a flow works as well with an API key and a monthly invoice, we say so in design. A discovery call fixes scope and timeline. Bring the first flow you want to measure.
06
What you can launch with us
- Pay-per-call pricing for an API, dataset, model or article, settled on your facilitator's chains
- An AI agent that pays for tools, capped per payment, per day and per payee
- Agent wallets for your users, with caps they set and can revoke
- Checkout inside Copilot and Gemini through your payment provider; in ChatGPT, listings that send shoppers to your checkout
- Visa Intelligent Commerce and Mastercard Agent Pay acceptance for online card payments
- Machine-to-machine billing below a cent a call, batched so you do not pay gas on every call
- Agent payments reconciled into your ledger, each tied to its order, call or invoice
- 24/7 monitoring and a kill switch that revokes an agent's session key in one step
07
The wallet, Safe and indexing work this builds on
The keys, the spending limits and the reconciliation carry most of the risk in an agent payment system, and each maps to work we do in production. Keys and limits sit in smart accounts and wallets: we deployed Safe across EVM networks, and we build account abstraction and wallets.
Reconciliation rests on indexing: we have built and open-sourced subgraphs on The Graph since 2019. We maintain Solhint, the Solidity linter, and we build AI agents for operations with guardrails, logging and human approval gates.
“Every payment is logged with the request that triggered it, so a person can audit what the agent bought and why.”
Production work this builds on
$2B+secured across the 120+ EVM networks where Protofire deployed Safe
We deployed Safe smart accounts with the contracts, indexing and interface on each of those networks. With its Allowance Module, a Safe is a direct way to cap what an agent can spend.
SafeView project →
18M+subgraph queries a day served across 15+ networks during the engagement
We authored and open-sourced subgraphs for protocols including Maker, Curve, Compound governance, UMA and Lens. An x402 payment settles as an onchain transaction, so the same kind of indexing joins each settlement to the order, API call or invoice it pays for.
The GraphView project →
Building agentic payments in-house vs with Protofire
| Build in-house | With Protofire | |
|---|---|---|
| Protocol coverage | You track x402, MPP, ACP, UCP and AP2 as each ships new versions | x402 or MPP for per-request flows, ACP or UCP for checkout, chosen per flow in design and integrated by us |
| Spending limits | You design and enforce limits in your own wallet code | Caps per payment, per day and per payee, enforced onchain (Safe Allowance Module, session keys) or by a wallet policy engine at signing |
| Liability and refunds | You design consent capture, refunds and dispute evidence | A signed mandate or passkey-approved instruction as the consent record, a refund path chosen per rail, and 120-day order confirmations where you act as the agentic payment provider |
| Compliance | You wire screening and Travel Rule data into each rail | Sanctions and KYT screening at the facilitator or wallet, with Travel Rule data passed into your existing compliance stack |
| Reconciliation | You build the mapping from settlement to ledger | Each settlement joined to its order, call or invoice through x402's payment-identifier extension and an indexer |
| After launch | Your team runs monitoring and incident response | Spend dashboards, anomaly alerts and a one-step kill switch, run 24/7 by us or by your team from our runbooks |
FAQ
What does an agentic payments integration include?
An agentic payments integration connects an AI agent, or the business it buys from, to a payment protocol and adds the controls around it. On the agent side that means a wallet or card credential with limits enforced at signing or onchain, and a client that answers payment requests. On the seller side it means a paywall or checkout endpoint and a facilitator or payment provider that settles. Screening, a refund path, reconciliation and monitoring sit around both, as the seven layers in the diagram above show. Protofire builds all of it, or the one layer you are missing.
Can you add x402 payments to our API?
Yes. Your server answers an unpaid request with HTTP 402 and a price, and returns the resource once a facilitator settles the agent's signed payment; the three-message exchange is set out under Paywalls for APIs above. The facilitator sets the cost: Coinbase's CDP facilitator charges $0.001 per onchain transaction after 1,000 free each month, Circle's pays settlement gas, and Stripe takes x402 on Base and settles to your Stripe balance in fiat. MPP can share the endpoint if you also want card payments, and prices below a cent settle in batches.
How do you stop an AI agent from overspending?
We put the limit somewhere the agent cannot change. x402's specification leaves "client-side budget management" out of scope, and a limit that lives only in the prompt can be overridden by the next instruction, so caps per payment, per day and per payee, allowlists and an expiry are enforced in the agent's smart account or by the wallet's policy engine before it signs. The Agent wallets and limits tab above lists the modules and wallets we use. We launch with low caps and human approval above a threshold, and raise them as the payment logs justify it.
Can merchants get paid by agents in ChatGPT, Copilot or Gemini?
In Copilot and Gemini, yes. Microsoft's Copilot Checkout reaches sellers through the Agentic Commerce Protocol (ACP) via Stripe, and Google's AI Mode and Gemini check out through the Universal Commerce Protocol (UCP). In ChatGPT, products are found through ACP product feeds and shoppers buy through your own checkout, since OpenAI wound down Instant Checkout in March 2026. The integration runs through your existing payment provider, so you remain merchant of record and keep your fraud and dispute tooling. For which protocol fits which store, see our agentic payment protocols guide.
How do refunds and disputes work for agent payments?
Refunds for agent payments depend on the rail, and on stablecoin rails we build the refund path in. Card payments made by an agent keep chargebacks, and Visa forbids merchants from making cardholders waive dispute rights on agentic transactions. Stablecoin transfers are final, so before launch we add x402's auth-capture scheme (hold, capture, void, refund), an authorize, capture and refund flow such as Coinbase Payment Acceptance, or an escrow contract. The person or business that delegated authority to the agent stays the payer of record; our agentic payment protocols guide sets out the liability rules protocol by protocol.
Do agent payments need KYC, AML or Travel Rule compliance?
They carry the same duties as any other payment, and the licensed party is you or your provider. Sanctions and KYT screening run at the facilitator or the wallet, and Travel Rule thresholds still apply: the EU has no low-value exemption for crypto transfers between providers, and the US rule applies at $3,000 or more. The Screening and the Travel Rule row above has the detail. We are not a money transmitter, a stablecoin issuer, an exchange, or a custodian, and we do not hold client or customer funds. We build and operate the software; where a flow needs a license you do not hold, we integrate a licensed partner.
Which chains and stablecoins do you support for agent payments?
Most x402 payments settle in USDC (99.6% of x402 value, per TRM Labs in September 2026), and your facilitator sets the chain list. Coinbase's facilitator settles on Base, Polygon, Arbitrum, Monad, World and Solana; Circle's on Arc, Base and Polygon PoS; and Stripe takes MPP on Tempo (USDC.e) and Solana (USDC) and x402 on Base (USDC). For cross-chain movement of USDC we use the current version of Circle's CCTP (Circle set its V1 contracts to pause on 1 December 2026), and Chainlink CCIP for other assets. A chain outside these lists gets scoped in design.
Is it too early to build agentic payments?
Not if the first build is small. Volume is still low, as the figures in the volume section above show, but Coinbase and Circle already settle x402 on mainnet and Copilot and Gemini run agent checkout. Build one flow you can measure, such as pay-per-call pricing for one API or one agent paying for its tools, and design it to widen without a rewrite.
Should we build agentic payments in-house or with a partner?
For most teams, partner for the first build and keep it in-house only if agent payments are the product you sell. A facilitator, wallet provider or payment network should own that core itself. For an API, store or agent that needs payments as a feature, an in-house build has to track five protocols that are still changing and settle keys, limits and refunds before the first agent pays. We build it on the wallet, smart-account and indexing work we do in production, and after launch we run it or hand your engineers the code, the limits design and the runbooks.
Discussed on The Protocol Roundtable
All episodesGet a proposal
Tell us what you are building. An engineer reads it, we have a short call, and the written proposal follows within one business day.
Budget
I accept the
Privacy PolicyI agree to receive new research announcements as well as information about Protofire services and special offers
An NDA is available from the first message and can cover anything you share. How it works