AI agents and payments: how machines pay for things
AI agents need ways to pay without a person at checkout. Here is how card-based and stablecoin-based protocols differ, and what is still unresolved.
Key takeaways
- AI agents that shop, book and buy need a way to pay that does not depend on a person entering card details each time.
- Two approaches are competing: commerce protocols built on cards and existing payment networks, such as Google’s UCP and AP2, and crypto-native ones such as Coinbase’s x402, which settles in stablecoins.
- x402 revives the long-unused HTTP 402 “Payment Required” code so software can pay for a service in a single web request.
- Adoption figures vary widely by source, and the category is early. The open questions are authorization, fraud liability and regulation.
The problem agents create for payments
Online payments assume a person is present: a checkout page, a card form, a confirmation step. An AI agent acting for a user, or for a company, has none of that. It may need to buy data, pay for compute, book a service or complete a purchase on its own, and it may do so in small amounts many times a day. Existing systems were not designed for that.
Approach one: commerce protocols on existing rails
Google launched its Universal Commerce Protocol, or UCP, in January 2026, with rollout across Search AI Mode and Gemini. It works with the Agent Payments Protocol, AP2, which uses signed “mandates” that set what an agent may spend and for how long. The design is payment-agnostic, so it can run over cards, bank transfers or other methods. Backers listed for the effort include retailers such as Walmart, Target and Shopify and payment firms such as Visa, Mastercard, Adyen and Stripe.
PayPal has taken a different route, supporting several protocols at once, including those from OpenAI and Google, rather than backing a single standard.
Approach two: crypto-native payments with x402
Coinbase created x402 in May 2025 as an open standard for stablecoin payments over the web. When software requests a resource, the server can answer with an HTTP 402 response that states the price, the stablecoin, the wallet address and the network. The requester signs a payment and gets access, typically in about two seconds, paying only a small network fee. No account or API key is needed.
The protocol has since been moved toward neutral governance under the Linux Foundation, and supporters include Cloudflare, Circle, Stripe, Amazon Web Services, Google, Microsoft, Visa and Mastercard. Stripe began supporting USDC payments for AI agents through x402 in February 2026. One industry tally counted about 35 million transactions by April 2026, but counts differ widely between sources, so treat any single number with caution.
Where the two approaches differ
| Commerce protocols (UCP, AP2) | x402 | |
|---|---|---|
| Best for | Shopping and checkout with merchants | Pay-per-use access to data, APIs and compute |
| Money | Cards, bank rails, any method | Stablecoins, mainly USDC |
| Controls | Signed mandates with limits | Per-request payment signed by a wallet |
| Accounts needed | Yes, through existing providers | No |
The unresolved questions
- Authorization. How much can an agent spend, on what, and who sets the limit?
- Liability. If an agent buys the wrong thing or is tricked into a payment, who bears the loss: the user, the merchant or the provider?
- Regulation. Stablecoin payments fall under the GENIUS Act framework in the US, while card-based agent payments sit under existing consumer protection rules that were not written with agents in mind.
- Real demand. Much of the early volume is developers and tests. Whether consumers and companies hand real budgets to agents at scale is still unproven.
What to watch
Watch whether the protocols converge, since several major companies back more than one. Also watch for the first large enterprise deployments where an agent has a real spending budget, and for any US guidance on liability for agent-initiated payments.
Sources and further reading
Frequently asked questions
What is x402?
An open standard created by Coinbase that revives the HTTP 402 Payment Required code so software can pay for web resources with stablecoins in a single request.
What are UCP and AP2?
Google's Universal Commerce Protocol and Agent Payments Protocol. They let agents shop with merchants, using signed mandates that set spending limits, over cards or other payment methods.
Can AI agents really spend money today?
Yes, in limited ways. Early use is mostly developers paying for data and compute and pilots with merchants. Large-scale consumer use is unproven.
Who is liable if an agent makes a bad payment?
This is unresolved. Liability among the user, merchant and payment provider is still being worked out in contracts and policy.
This explainer is reviewed and updated as the rules and the market change. Last reviewed October 5, 2026. It is educational content and not financial, legal or tax advice.