Agent payment protocols explained: x402, AP2, ACP, and x401

Why agent payments need new protocols at all

The payment stack assumed a human at the point of decision. Card-not-present rules, 3D Secure challenges, CAPTCHA walls, and fraud models that score mouse movement all exist to confirm a person is present and consenting. An AI agent breaks every one of those assumptions at once: it has no finger for the fingerprint reader, it fails challenge flows designed to stop bots because it is one, and a merchant that cannot distinguish a customer's shopping agent from a credential-stuffing script will block both. The result, documented across the Know Your Agent debate, is that agents either get refused outright or get waved through on stored credentials with no proof the human approved this purchase, this amount, this merchant. Protocols emerged to replace both failure modes with signed, verifiable intent.

x402: payments as an HTTP status code

Coinbase's x402, published in May 2025, resurrects the dormant HTTP 402 Payment Required status code. A server answers an agent's request with 402 and a price; the agent pays, typically in stablecoins over on-chain rails, retries the request with payment proof attached, and receives the resource. The design is machine-native and merchant-light: no accounts, no card vaulting, no checkout page, which suits micropayments for API calls, data access, and per-use services. What x402 deliberately does not carry is identity. It proves payment happened, not who stood behind the paying agent, which is why Proof's x401 and similar layers position themselves one number earlier in the status-code namespace: authenticate and authorize first, then pay.

AP2: mandates as the unit of authorization

Google's Agent Payments Protocol, announced in September 2025 with partners including Mastercard, PayPal, American Express, and dozens of others, is the most explicit about authorization semantics. AP2's core objects are mandates: cryptographically signed, tamper-evident records of what the human approved. An intent mandate captures the instruction, find me running shoes under 120 dollars, while a cart mandate signs the exact final basket, and the chain from human to agent to merchant is built from verifiable credentials, giving every party a non-repudiable audit trail. AP2 is payment-method agnostic, cards, bank transfers, and stablecoins alike, and its mandate structure is the closest thing the field has to a shared answer for the delegation problem: scope, expiry, and accountability expressed as signed artifacts rather than terms-of-service prose.

ACP: the checkout that ships today

The Agentic Commerce Protocol, built by OpenAI with Stripe and released in September 2025, powers Instant Checkout in ChatGPT. Its bet is pragmatic: keep the merchant of record in place, pass payment through tokenized credentials, and let the platform handle the conversation while the merchant handles fulfillment. Shopify and Etsy merchants came online first, which matters for scale: ACP is less a new rail than a bridge letting conversational platforms submit orders into existing commerce infrastructure. The trade-off is concentration. The platform operating the agent also brokers the transaction, so merchants accept a new intermediary between themselves and the customer, and the authorization evidence lives substantially inside that intermediary's walls.

The card networks and x401: trust frameworks on top

Visa's Trusted Agent Protocol and Mastercard's Agent Pay, both launched in 2025, approach the problem as network governance: registered, credentialed agents receive cryptographic identities the network recognizes, so issuers and merchants can apply agent-specific rules, the interoperability push covered previously on The Deep Brief. Proof's x401, published in June 2026 and extended this week with an agent identity wallet, supplies what the payment-first protocols defer: verified identity of the human principal, signed authorization for the specific action, and a portable evidence object the relying party can keep. In Proof's framing, the Agent Evidentiary Gap, the space between what an agent can do and what it can prove it was authorized to do, is the reason platforms like Amazon block unverified agents rather than transact with them.

Where the protocols leave the identity question

Read together, the stack splits into three layers that do not substitute for each other. Payment execution, x402 and the processor integrations, moves money. Authorization semantics, AP2 mandates and x401 evidence, record consent. Network trust, the card-scheme registries, decide which agents may participate at all. The unsolved joint is at the bottom: every mandate, credential, and registry entry chains back to an initial verification of the human principal, and the chain is only as strong as that enrollment. A fraudster who passes onboarding with a synthetic identity mints perfectly valid mandates for perfectly fraudulent purchases, signed, auditable, and wrong. This is the inheritance rule every credential system obeys, and it is why agent authentication keeps returning to verified enrollment, strong principal binding, and transaction-time checks rather than resting on protocol compliance.

What operators should build now

For merchants, platforms, and financial institutions, four moves are defensible regardless of which protocol wins. Accept signed mandates as evidence, not verdicts: parse them, verify the chain, and score them in a decision plane alongside device, velocity, and identity signals. Demand principal verification at enrollment, because a mandate from an unverified human is a liability instrument. Keep high-risk actions behind human-present approval ceremonies, the pattern approval research keeps validating, so a compromised agent cannot escalate. And log the full authorization chain per transaction, since the examiner's question will not be which protocol you used, it will be prove this customer approved this transfer. The protocols are converging on signatures; the market still has to converge on who checks the signer.

A worked example: one purchase, three protocols

Trace a single instruction, book me the usual hotel for the conference, under 400 dollars, through the stack. The principal signs an intent mandate recording the instruction and its bounds, AP2 semantics, after authenticating with device biometrics. The agent, carrying an x401-style identity credential naming its principal, negotiates with the hotel platform, which checks the agent against a network registry before quoting. At confirmation, the agent presents a cart-level signature for the exact room, dates, and price, and the platform's risk engine scores the whole bundle, principal verification recency, mandate scope fit, device and velocity signals, before releasing the booking to payment, which could ride cards through tokenized credentials or an x402 settlement. Five artifacts, one purchase, and each one answers a different dispute: who asked, which agent, what exactly, authorized when, paid how.