SKIP TO CONTENT
AI AGENTS6 minStandards That Ship / Ep. 3 · Stage 3-1

x402 Agent Payments: Linking Each Payment to Its Approval

An AI agent pays for data with x402 and the payment goes through. If someone disputes it, what does that record actually prove?

XIN
Pixel-art illustration of a robot at a payment terminal tethered by a glowing cord back to a distant human silhouette.

IN 30 SECONDS

x402 is an open protocol that lets an API charge for a web request, including to an AI agent. Its records show a signed payment and how settlement went, not who approved the task or who answers for a mistake. Liability still depends on the facts, the contract and the law.

KEY TAKEAWAYS · 3

  • x402 carries a signed payment authorization and a settlement result. Linking the wallet to an accountable organization and its delegation policy is the app’s job. Liability depends on the facts, the contract and the applicable law.
  • Know Your Agent applies KYC to agents: who runs it, and who does it act for? Knowing who it is and letting it pay are two different checks.
  • An on-chain claim or a signed off-chain credential can link an agent to its principal, but only if the verifier trusts the issuer and checks it is still valid.
On this page

The agent paid. Now who is liable?

IN SHORT A payment that goes through is only part of the evidence a team needs when an agent’s purchase is questioned.

WORDS TO KNOW

x402
An open protocol that lets a website or API ask for payment inside a web request, using the web’s status code 402 Payment Required.
Principal
The person or organization an agent acts for, who gave it the power to spend.
Liability
Legal responsibility for a loss. The facts, the contracts and the applicable law decide it, not the payment code.

Picture an agent that buys API access, the interface programs use to call a service, out of a team budget. This scenario is illustrative. It pays through x402 An open protocol that lets a website or API ask for payment inside a web request, using the web’s status code 402 Payment Required. See the glossary, and the data arrives.

That proves the payment path worked. A dispute asks other questions, starting with the Principal The person or organization an agent acts for, who gave it the power to spend. See the glossary who owns the agent and the task it approved.

WHAT THE PAYMENT SHOWS, WHAT A DISPUTE ASKS

What the payment shows

  • A payment authorization signed by the agent’s wallet.
  • The amount and the recipient.
  • A settlement result: paid, or rejected.

What a disputed purchase asks

  • Who approved this task, and when?
  • Which limit applied, and was it enforced?
  • Who owns and runs the agent?
Illustrative. x402 gives you the left column. Your application has to keep the right one.

A payment record can’t say who carries the loss. That is a question of Liability Legal responsibility for a loss. The facts, the contracts and the applicable law decide it, not the payment code. See the glossary. The facts, the contract and the law that applies decide it.

ADAM says: Picture a company card for a new hire: the card limit is the spending rule, the signed policy is the delegation record, the receipt is the x402 record. The image breaks on intent: an agent’s own explanation is weak evidence.

Coming up next: So what does the x402 record contain, exactly?

What x402 does, and what it leaves open

IN SHORT x402 handles the price, the signed payment and the settlement. Linking that payment to a principal and an approved task is the application’s job.

x402 is a payment protocol Coinbase introduced in 2025. It revives HTTP 402 Payment Required, a web status code that was rarely used. The client, which may be an agent, pays with an accepted asset, such as a stablecoin designed to track a currency.

STEP BY STEP

Sequence diagram: 3 participants: Agent, Paid API, BlockchainSequence diagram: 3 participants: Agent, Paid API, Blockchain. Step 1: Agent to Paid API, Request a paid resource. Step 2: Paid API to Agent, 402 Payment Required: price, network, address. Step 3: Agent to itself, Sign a payment authorization. Step 4: Agent to Paid API, Retry with the signed payment. Step 5: Paid API to Blockchain, Verify, then settle the payment. Step 6: Paid API to Agent, Resource and settlement result, or an error.AGENT > PAID APIRequest a paid resourcePAID API > AGENT402 Payment Required: price,network, addressAGENT > AGENTSign a payment authorizationAGENT > PAID APIRetry with the signed paymentPAID API > BLOCKCHAINVerify, then settle thepaymentPAID API > AGENTResource and settlementresult, or an error

Step 1. Request. The agent asks a paid API for a resource.

Pick a step to see it move
  1. Request The agent asks a paid API for a resource.
  2. Price The API answers 402 Payment Required, with the price, the network and where to pay.
  3. Sign The agent’s wallet signs a payment authorization. In the core flow, nothing in it says which task or budget a person approved.
  4. Retry The agent sends the same request again, with the signed payment attached.
  5. Settle The API checks the signature and settles the payment on the chain. When funds move depends on the payment scheme; some settle later, in batches.
  6. Result On success, the API returns the resource with a settlement result; on failure, an error.
The core x402 flow, simplified from its docs. Steps 3 and 6 are its evidence. The business approval behind step 3 has to come from your application or a compatible extension.

A settled x402 payment is good evidence of the payment, and only of the payment.

IN PLAIN WORDS

The x402 docs say a server doesn’t need to track who its clients are. Extensions can add identity and signed receipts, but tying the payment to your rules and the approved task is still your app’s job.

Coming up next: So who checks the agent behind the wallet?

Know Your Agent is KYC, moved to the agent

IN SHORT Know Your Agent is a useful name for checking who runs an agent and what it may do, the way KYC checks a customer.

KYC means Know Your Customer: the identity checks a bank runs, starting when you open an account. For an agent, one more question joins the list: who does it act for?

KYC VS KYA

KYC, for a person

A private identity record can support an institution’s checks. Sharing it needs an agreed way to verify it, and privacy controls.

KYA, for an agent

A compatible verifier can check a signed link to the principal against trusted issuers, validity and revocation. A separate policy decides which actions that identity may take.
Same idea, new holder: the agent instead of the customer.

Across services, that link can be an on-chain claim or a signed credential kept off-chain, outside the blockchain. Neither is trustworthy by itself. The verifier must accept the issuer, check that the claim is still valid and tie it to the action.

ITEM GET

Identity is not a spending rule

KYC can help prove who someone is. Knowing who an agent is and letting it pay are two different checks, so a verified agent still needs its own rule for what it may spend.

Sources: x402 payment authorization (HTTP 402), x402 client and server roles.

STAGE CLEAR

What you now know

  • A settled x402 payment shows the wallet signed and the payment went through, not who approved the task.
  • Who carries a loss is decided by the facts, the contract and the law, not by the payment record.
  • Know Your Agent links an agent to its principal; a separate rule still says what it may spend.

Check yourself

Tap or click a question to see the answer.

An agent’s wallet signature on an x402 payment is valid. Does it show that a person approved the purchase?

No. In the core flow, the signed authorization carries no task or budget approval. That link has to come from your app or a compatible extension.

Next stage:Which standards can tie an agent to its principal and to its spending limits?6 min
Adam Boudjemaa
Adam Boudjemaa

Former CTO of Integra. Named author (1 of 5) of ERC-3643, first author of ERC-6960, co-author of ERC-7410, and co-author of ERC-8203, which is still a draft. Building production AI and regulated Web3 systems.

Have a project to ship or a role to fill?

Discuss your project or role
LinkedInTwitterGitHub
Follow the engineering notes

Get new articles on production AI and smart contracts by email.