Two strands of agentic payment standards: proof of permission and the movement of money

In April 2026, the companies that created two payment standards for AI agents (AI programs that handle tasks on a person's behalf) each announced that they would hand them over to neutral bodies. On April 2, the Linux Foundation announced the establishment of the x402 Foundation to take over x402 (a standard that embeds payments in web requests), which Coinbase created. On April 28, Google announced that it would donate the Agent Payments Protocol (AP2) to the FIDO Alliance (an industry body that develops online authentication standards). The x402 contribution was completed on July 14, and the foundation began full operations with 40 members. x402 deals with how money is moved, and AP2 with how to prove that a person authorized a payment.

Scope of payments entrusted to agents

Agentic payments are payments in which a user sets limits and conditions in advance and an agent chooses and pays on its own within them. Visa's April 2025 announcement likewise stated that consumers set the spending limits and conditions, and that only consumers can instruct an agent on what to do and when to use their payment method.

Two scenarios in the September 2025 AP2 announcement show that scope. In the first, a person is present. When the user asks the agent to find white running shoes, the agent presents a shopping cart, and the user approves it by signing that cart. In the second, the person is away. The user asks the agent to buy concert tickets the moment they go on sale, signing conditions such as a price limit and timing in advance. When the conditions are met, the agent creates a cart on the basis of that signature.

Standards for proving permission: Google AP2 and the FIDO Alliance

The AP2 announcement noted that today's payment systems generally assume a person is directly clicking "buy" on a trusted screen. Agents that initiate payments on their own break this assumption. The announcement therefore stated that a common foundation is needed for confirming and conveying the authority to transact. AP2 identified three questions.

1. Authorization: proof that the user gave the agent authority for a specific purchase
2. Authenticity: the seller confirming that the agent's request matches the user's true intent
3. Accountability: where responsibility lies when a fraudulent or erroneous transaction occurs

AP2's answer is the "mandate," a digital contract cryptographically signed so that it cannot be tampered with, which serves as evidence of the user's instructions. The signatures use verifiable credentials, a Recommendation of the World Wide Web Consortium (W3C), the web standards body. Mandates are divided into intent mandates and cart mandates to match the two scenarios.

AP2 stated that this record, running from intent to cart to payment, answers the authorization and authenticity questions. On accountability, it stated only that the record provides "a clear foundation."

The FIDO Alliance pointed to the same problem in its April 2026 announcement. It observed that users may need to hand credentials over to agents, but service providers have no common way to confirm who authorized that action, under what conditions and within what limits. FIDO formed a new agent authentication working group, and the agent payment standards are being developed in the payments working group chaired by Mastercard and Visa.

The starting points for the payment standards are Google's AP2 and the Verifiable Intent specification that Mastercard developed with Google. Google explained that this specification keeps an unalterable record of the agent actions a user has authorized, so that accountability can be determined later.

A standard for moving money: status code 402, reserved since 1997

The standards documents (RFCs) for HTTP, the rules for web communication, have included the status code "402 Payment Required" since the 1997 edition. Its description was a single line, "reserved for future use," and the current standard, the 2022 revision, contains the same wording. CoinDesk reported that the name x402 comes from this code 402.

Under x402, when a request arrives without payment, the server responds with 402, and the requester pays and then sends the same request again. According to the official website, this process requires neither an account nor personal information.

Its main use is stablecoin payments, but the official website states that it is not tied to any particular network, and the Linux Foundation's July announcement also describes its scope of support as ranging from traditional cards to stablecoins. At the time of the April announcement, the 22 organizations that expressed support and an intention to join as members included Visa and Mastercard.

Approaches within the card networks

Visa Intelligent Commerce, announced in April 2025, is a business program rather than a standard, and opens the Visa payment network to AI agent developers. It uses tokenized credentials that replace card details, and shares transaction signals with Visa in real time to help with dispute management. Its introduction page carries a notice that the product is being rolled out and that some features may not be included in the final version.

In October 2025, Visa also introduced the Trusted Agent Protocol, developed with Cloudflare. It attaches a cryptographic signature to each agent to distinguish agents that intend to buy from malicious bots, addressing the authenticity question on the card network side.

Mastercard announced Agent Pay in April 2025. It adds agentic tokens on top of existing tokenization technology so that only registered and verified agents can make payments.

In September 2025, Stripe and OpenAI released the Agentic Commerce Protocol (ACP) as open source that anyone can use. In this structure, the agent passes payment information to the seller's payment processor using a secure token. The seller remains the party to the transaction.

USD 28,000 a day, transaction volume at the testing stage

Actual transaction volume is still small. According to a CoinDesk report on March 11, 2026, a recent daily count showed about 131,000 x402 transactions worth about USD 28,000. That is an average of about 20 cents per transaction. On one day in February, 3.8 million transactions totaling about USD 2 million were recorded. Artemis, a blockchain data analytics firm, considered a substantial part of that surge to have come from infrastructure testing and experimental use.

Artemis also classified about half of the observed x402 transactions as artificial activity. Examples include self-trading, in which the same wallet both buys and sells, and wash trading, in which a seller funds a buyer's wallet and gets the money back right after the transaction. The article added that such transactions are expected in the early testing phase, and Artemis expected this share to decline naturally as activity shifts to real use.

In the same article, Noah Levine of the investment firm a16z crypto explained that because payment processors take on the risk of their merchants, small tools without a website, a legal entity or a track record are difficult to vet. CoinDesk noted that x402 is aimed at a new area, small automated services used by software, rather than at replacing cards.

Korean participation and the distance from a won framework

The x402 Foundation's July member list includes three Korean companies as general members: Kakao Pay, Hecto Financial and Galaxia Moneytree. Kakao Pay said on September 15 that it had carried out a proof of concept of agentic payments on both the buying and selling sides (reported by Money Today). Hecto Financial said it had completed technical verification of agent payments based on Google's AP2 in June (reported by Newspim on July 20).

Membership and technical proofs of concept are a different stage from commercial services. The proposed Digital Asset Basic Act (working title), a bill under discussion, would bring won-denominated stablecoins into the regulatory framework. As far as could be confirmed from reports as of the reference date, the government bill has not yet been submitted to the National Assembly.

Four questions for the industry to settle together

The standards define the format for recording permission and the route by which money moves. Four matters lie outside them.

First, a common format for proof of permission. There are several approaches, such as AP2 and Verifiable Intent, Visa's agent signatures, and Mastercard's registration and verification. The key issue is which of these formats Korean payment companies and merchants need to be able to read and verify.

Second, the allocation of responsibility. Card networks come with dispute management, and ACP treats the seller as the party to the transaction. When an agent payment made in stablecoins goes wrong, the standards alone do not settle who decides, and under what rules, the respective shares of the user, the agent operator, the seller and the wallet provider.

Third, account-free payments and KYC. The x402 official website cites the know-your-customer (KYC) checks required when registering a payment method as an inconvenience of existing methods. The Act on Reporting and Using Specified Financial Transaction Information requires financial companies, including virtual asset service providers (VASPs), to carry out customer due diligence (CDD) and to refuse new transactions when verification is not possible. The issue is at which point, and on whom, KYC checks should be carried out in payments made without accounts.

Fourth, a place within the won framework. As the government bill for the Digital Asset Basic Act is finalized, the task is how to link payments made by agents acting under a person's delegation to requirements on user protection, limits and record-keeping.

Governance of the standards is moving from companies to neutral bodies, but the four questions are criteria for payment companies, sellers and policy authorities to set together, outside the standards.