Mastercard opens Agent Pay for Machines early access to test HTTP 402-triggered AI payments
Oct. 27, 2026 • Deep Dive • AI in Fintech
Mastercard opened developer early access for Agent Pay for Machines (AP4M) on October 20, 2026, releasing buyer- and seller-side APIs, a sandbox and developer toolkits. In a Cloudflare Connect demonstration, marketing agency Hype tested an autonomous agent making nine payments to two merchants within a single budget, without manual billing or account setup.
AP4M uses HTTP 402 payment challenges, but differs from crypto-native implementations of the x402 protocol. Its agents issue digitally signed vouchers off-chain; merchants can batch and redeem them later instead of settling every request on-chain. The pilot combined agent wallet infrastructure from Coinbase Developer Platform and BVNK, settlement on Base, and Mastercard’s multi-currency fiat and stablecoin settlement platform. Circle separately expanded its managed payments service to target AI-agent traffic using USDC. Together, the developments show competing approaches to machine-to-machine payments, with different choices about settlement, funding and who manages digital assets.
Mastercard opened developer early access for Agent Pay for Machines (AP4M) on October 20, 2026, moving its AI-agent payments initiative from proof of concept into a testing phase. Announced at Cloudflare Connect, the first release includes buyer- and seller-side APIs, a sandbox and developer toolkits. It gives developers a way to test payments initiated by software agents in response to requests from digital services.
In a demonstration at the event, marketing agency Hype tested an autonomous agent that made nine separate payments across two merchants, AIsa and Cloudflare AI Gateway. The payments stayed within a single budget and required no manual billing or account setup. The test illustrates the intended use case: an agent accessing paid services as it works, rather than stopping for a person to arrange each purchase.
How HTTP 402 becomes a payment request
The approach builds on x402, an open protocol that puts the HTTP 402 “Payment Required” status code to work. Defined in RFC 9110, the code allows an API endpoint to respond to a machine client with a payment challenge. An AI agent requesting a paid service can then receive a machine-readable instruction to pay, instead of being directed through a conventional billing setup.
Coinbase Developer Platform originally developed x402 before the protocol moved to vendor-neutral governance under the Linux Foundation’s x402 Foundation on July 14, 2026. That history matters because HTTP 402 is the shared entry point for payment requests, not a single prescribed way to fund or settle them. Different implementations can use the same payment challenge while handling the resulting transaction differently.
Mastercard first announced AP4M on June 10, 2026, with more than 30 partners. The October release is a narrower operational milestone: developers can now work with its initial APIs and sandbox. The Hype demonstration tested the payment flow, but the early-access designation does not establish that the service is generally available.
Vouchers separate each request from settlement
Under Mastercard’s AP4M flow, an agent responds to an HTTP 402 challenge by issuing a digitally signed payment voucher off-chain. The merchant can collect vouchers and redeem them later in a batch. It need not submit a separate on-chain transaction for every paid request.
That design differs from crypto-native x402 implementations that favor immediate, atomic stablecoin settlement on-chain for each request. Mastercard’s model defers settlement and supports multiple settlement rails, including fiat funding. Batching also avoids the need to incur an on-chain transaction cost for every individual call. The distinction is significant for services that may charge an agent repeatedly as it completes a task: the payment request can be immediate even when final settlement is not.
The demonstrated architecture assigned distinct roles to several providers. Coinbase Developer Platform supplied agent wallet infrastructure, while BVNK acted as the agent wallet provider. Base handled on-chain settlement, and Mastercard Global Money Platform enabled multi-currency fiat and stablecoin settlement. Those components show how AP4M can link a machine-initiated purchase to payment infrastructure beyond a single on-chain transfer.
Other models and controls
Circle took a different step on October 19, expanding Circle Payments Network Managed Payments to target autonomous AI-agent traffic. Its offer enables digital service providers to monetize machine-to-machine requests using USDC without managing digital asset custody. Like AP4M, it addresses the question of how to charge software for digital services, but the verified details do not establish that the two offerings use identical payment or settlement flows.
Agent payments also raise questions about authorization and recourse. Native on-chain x402 transfers are irrevocable once completed, unlike card payments, which can permit chargebacks up to 120 days after a transaction. Intermediary networks therefore face a need for controls such as tokenized agent credentials, described as “Know Your Agent,” and guarantee layers. The available details do not specify how any such protections operate in AP4M’s early-access release.
At Sibos 2026 in Miami on September 29, Federal Reserve Governor Christopher Waller distinguished between “agentic-assisted” and “agentic-delegated” commerce. He identified business-to-business workflows as a practical early fit for delegated activity because suppliers can be whitelisted and budgets set in advance. Hype’s single-budget test demonstrates one of those constraints in action; broader adoption will depend on how payment providers implement authorization, settlement and safeguards beyond a controlled demonstration.
Mastercard opened developer early access for Agent Pay for Machines (AP4M) on October 20, 2026, releasing buyer- and seller-side APIs, a sandbox and developer toolkits. In a Cloudflare Connect demonstration, marketing agency Hype tested an autonomous agent making nine payments to two merchants within a single budget, without manual billing or account setup. AP4M uses HTTP 402 payment challenges, but differs from crypto-native implementations of the x402 protocol. Its agents issue digitally signed vouchers off-chain; merchants can batch and redeem them later instead of settling every request on-chain. The pilot combined agent wallet infrastructure from Coinbase Developer Platform and BVNK, settlement on Base, and Mastercard’s multi-currency fiat and stablecoin settlement platform. Circle separately expanded its managed payments service to target AI-agent traffic using USDC. Together, the developments show competing approaches to machine-to-machine payments, with different choices about settlement, funding and who manages digital assets.
Visa launched a live pilot with BILL and Billtrust at Money20/20 USA in late October 2026 to test end-to-end B2B invoice payments executed by software agents. The agents act on invoices enterprise buyers have already approved; they do not decide which supplier payments to authorize. Visa’s Trusted Agent Protocol and Agentic Directory are designed to authenticate those agents when they access supplier and merchant portals without shared credentials or manual human login. Separately, Visa has put Commercial Payment Controls into production for eligible issuers in supported regions, allowing businesses to set limits and restrictions on corporate spending. The company plans general availability of Commercial Virtual Authentication and Commercial Supplier Validation in 2027 after pilot completion. Its SESA 2.0 analytics platform has identified more than $600 billion in potentially cardable supplier spend. The pilot tests whether approved invoice payments can be executed through automated workflows while preserving buyer-defined controls.
Mastercard and Visa are advancing different approaches to AI-initiated business payments. At Cloudflare Connect, Mastercard demonstrated an agent making nine payments across multiple service providers under one authorized budget. It also opened early developer access to Agent Pay APIs, a sandbox and toolkits. Visa expanded its commercial agentic suite around a BILL and Billtrust pilot, alongside spend analytics and fraud tools. The distinction is how each approach constrains the agent. Visa’s pilot lets an agent pay invoices that buyers have already approved, using its Trusted Agent Protocol to navigate supplier-portal security without sharing underlying login credentials. Mastercard is testing controls for machine-to-machine transactions, including signed vouchers, agent verification and a score intended to estimate whether an incoming transaction was AI-initiated. Both efforts leave a consequential question for business payments: how responsibility should be assigned when an authorized agent follows its technical instructions but breaches a procurement condition.
Mastercard opened developer APIs, SDKs and a sandbox for Agent Pay for Machines (AP4M) on October 21, 2026. The tools enable autonomous AI agents on Amazon Bedrock to make multi-merchant micropayments over x402 using off-chain signed vouchers. The launch follows Coinbase Developer Platform’s report that cumulative x402 payments across Base and Solana had exceeded 100 million by October. The x402 protocol uses an HTTP 402 response to tell an agent what a service costs and how to pay. Its growing infrastructure includes a Linux Foundation-governed foundation, while alternative approaches use Lightning payments or existing processor rails. Transaction counts, however, do not establish how much genuine agent-led commerce is taking place. TRM Labs found a much smaller pool of plausible commercial trade after screening out other activity. Security questions also remain, including whether a service can receive payment without delivering its output. Developers therefore face choices about settlement, spending controls and proof of service.
CapitalOS completed a $21.9 million Series A financing round on October 21, 2026, led by LGVP. The company plans to expand its engineering team and scale the infrastructure behind its AI-driven money orchestration platform. WEX Venture Capital, Group 11, Great North Ventures, Night Capital and existing early investors also participated. Founded in 2022, CapitalOS helps vertical SaaS and AI platforms offer embedded charge cards, digital wallets and automated bill payments without maintaining in-house licensing or risk operations. Its architecture uses five specialized AI agents across underwriting, capital, compliance, risk and fraud, and support. Property management platform Guesty is an active customer, and CapitalOS reports managing transactions for more than 25,000 active cardholders across dozens of integrated platforms. CapitalOS relies on infrastructure provider Increase and its chartered partner banks rather than replacing depository institutions. The announcement did not disclose a valuation, credit warehouse partner or the identities of its current primary sponsor banks.
Visa, BILL and Billtrust announced a live commercial pilot on October 20, 2026, that lets AI agents initiate and execute approved business invoice payments through supplier portals. The BILL Payment Agent uses tokenized payment credentials restricted to buyer-authorized invoices and predefined rules. Billtrust authenticates the agent through Visa’s Agentic Directory and Trusted Agent Protocol without requiring shared login credentials. The pilot tests how an agent can establish its identity and payment authority, but it does not give the agent authority to approve invoices independently. Visa’s protocol uses cryptographic signatures to bind requests to a particular merchant domain and page. The distinction matters for liability: commercial payment protections may be altered by contract, while AI software agreements may limit vendor exposure. Visa separately announced expanded commercial capabilities on October 21, with supplier validation and authentication controls scheduled for general availability in 2027. The EU’s draft Payment Services Regulation does not directly address autonomous agent payments.