Mastercard Opens Agent Payment Tools as x402 Tops 100 Million Payments, but Autonomous Use Remains Unclear
Oct. 24, 2026 • Deep Dive • AI in Fintech
Mastercard opened developer APIs, SDKs and a sandbox for Agent Pay for Machines (AP4M) on October 21, 2026. The tools enable autonomous AI agents on Amazon Bedrock to make multi-merchant micropayments over x402 using off-chain signed vouchers. The launch follows Coinbase Developer Platform’s report that cumulative x402 payments across Base and Solana had exceeded 100 million by October.
The x402 protocol uses an HTTP 402 response to tell an agent what a service costs and how to pay. Its growing infrastructure includes a Linux Foundation-governed foundation, while alternative approaches use Lightning payments or existing processor rails. Transaction counts, however, do not establish how much genuine agent-led commerce is taking place. TRM Labs found a much smaller pool of plausible commercial trade after screening out other activity. Security questions also remain, including whether a service can receive payment without delivering its output. Developers therefore face choices about settlement, spending controls and proof of service.
Mastercard opened developer APIs, SDKs and a sandbox for Agent Pay for Machines (AP4M) on October 21, 2026, giving developers a way to build autonomous AI agents that make multi-merchant micropayments. Announced at Cloudflare Connect 2026 in San Francisco, the tools support agents on Amazon Bedrock paying over the x402 protocol with off-chain signed vouchers.
The release puts a practical question behind agentic commerce in focus: how can software pay for an API call or other small service without sending a person through checkout for every request? Coinbase Developer Platform reported more than 100 million cumulative x402 payments across Base and Solana by October 2026, driven by integrations with Model Context Protocol (MCP) clients and autonomous agent frameworks. That count shows protocol activity, but it does not by itself establish how many purchases were genuine autonomous commerce.
How an HTTP 402 payment works
The x402 protocol uses HTTP status code 402 as a payment challenge. An API server responds to a request with a specified token, price and receiver address. The requesting agent can then return a signed payment payload. One possible payload is an EIP-3009 authorization to transfer USDC; a facilitator verifies it and settles the payment on-chain. The exchange lets payment instructions travel with the service request rather than through a separate human checkout flow.
HTTP 402 itself is not a newly ratified internet payment standard. Under the current IETF HTTP semantics in RFC 9110, the code remains “Reserved for future use.” Protocols such as x402 are application-layer conventions built around that reserved response, not changes to the core HTTP standard.
Mastercard’s AP4M implementation introduces another element to the settlement stack: off-chain signed vouchers for the multi-merchant micropayments it supports over x402. Off-chain vouchers provide a different way to handle payment instructions from settling every small interaction directly on-chain. The distinction matters because traditional card processing fees of roughly 2.9% plus $0.30 per transaction make sub-cent API purchases uneconomic on those terms; layer-2 crypto settlement and off-chain voucher netting are among the approaches being developed for smaller payments.
Competing ways to authorize and settle
Other protocols address parts of the same problem differently. Lightning Labs’ L402 combines an HTTP 402 challenge with restricted cryptographic credentials known as macaroons and Lightning Network payment preimages, which demonstrate that a payment was made. Its Aperture gateway can check credentials and payment without querying a centralized account database.
Google’s Agent Payments Protocol (AP2), by contrast, focuses on verifiable authorization rather than operating its own crypto settlement network. It separates Checkout Mandates, which define what goods or services an agent may buy, from Payment Mandates, while leaving settlement to traditional payment processors. These approaches are not interchangeable: an agent needs both permission to spend and a way to complete and verify payment.
Wallet design adds a further control layer. Production agentic wallet stacks use Multi-Party Computation and Trusted Execution Environments to keep cryptographic keys out of an AI model’s prompts and context window. Programmatic limits can restrict spending per session, permitted function calls and destination addresses. Those safeguards address what an agent is allowed to do, regardless of which payment protocol carries the request.
Growth claims meet commercial-use questions
The x402 ecosystem gained a formal governance home when the Linux Foundation transitioned the x402 Foundation to full operational status in July 2026, after Coinbase completed its protocol contribution. Its vendor-neutral governance is backed by members including Visa, Stripe, Amazon Web Services, Google, Cloudflare and Circle. On October 1, the foundation appointed former Amazon and PwC payments veteran Michael Hursta as executive director; it had grown to more than 50 member institutions.
High payment counts require careful interpretation. While Coinbase and foundation metrics reported more than 100 million x402 transactions and 75 million settlements over a 30-day period, blockchain intelligence firm TRM Labs found $25.62 million in plausible commercial trade after screening out self-payments and liquidity routing. Its analysis attributed only 0.6% to 7.5% of value to actual autonomous AI agents rather than automated test scripts or benchmarking bots. The figures measure different things and should not be read as equivalent adoption estimates.
There is also a service-delivery problem to solve. Academic researchers identified an end-to-end atomicity vulnerability in standard x402 flows: a provider could capture an on-chain payment without delivering the requested inference output. They developed a trust-minimized approach called A402 using Trusted Execution Environment-assisted adaptor signatures. The work highlights a distinction between verifying that money moved and ensuring the buyer received the service.
Card-network and crypto-native approaches still differ on the right settlement model. Mastercard’s AP4M and other incumbent-backed approaches emphasize existing payment rails and virtualized credentials, while Web3 developers point to card chargebacks, human identity requirements and fixed fees as obstacles to fully autonomous micropayments. For developers, the emerging choice is not simply whether agents can initiate a payment. It is how to combine authorization, affordable settlement and enforceable delivery in one transaction.
The Linux Foundation appointed payments veteran Michael Hursta executive director of the x402 Foundation on October 1, 2026, as payment systems designed for autonomous AI agents gained attention. Foundation members reported more than 75 million agentic payment transactions in a 30-day period in September, and Coinbase and Amazon Web Services showcased production payment rails at Sibos 2026. Reported transaction counts, however, do not establish the value or commercial character of that activity. The emerging protocols address different obstacles. Coinbase’s x402 enables per-request USDC payments through HTTP, while Google’s Agent Payments Protocol uses signed mandates to connect an agent’s purchases to a user’s authorization. Stripe and Tempo have also proposed session-based billing through the Machine Payments Protocol. These approaches respond to card fees and interactive checkout checks that can impede small, automated transactions. Card networks are developing delegated-identity tools, leaving multiple potential paths for agent payments rather than a single replacement for existing rails.
Mastercard opened developer early access for Agent Pay for Machines (AP4M) on October 20, 2026, releasing buyer- and seller-side APIs, a sandbox and developer toolkits. In a Cloudflare Connect demonstration, marketing agency Hype tested an autonomous agent making nine payments to two merchants within a single budget, without manual billing or account setup. AP4M uses HTTP 402 payment challenges, but differs from crypto-native implementations of the x402 protocol. Its agents issue digitally signed vouchers off-chain; merchants can batch and redeem them later instead of settling every request on-chain. The pilot combined agent wallet infrastructure from Coinbase Developer Platform and BVNK, settlement on Base, and Mastercard’s multi-currency fiat and stablecoin settlement platform. Circle separately expanded its managed payments service to target AI-agent traffic using USDC. Together, the developments show competing approaches to machine-to-machine payments, with different choices about settlement, funding and who manages digital assets.
Visa launched a live pilot with BILL and Billtrust at Money20/20 USA in late October 2026 to test end-to-end B2B invoice payments executed by software agents. The agents act on invoices enterprise buyers have already approved; they do not decide which supplier payments to authorize. Visa’s Trusted Agent Protocol and Agentic Directory are designed to authenticate those agents when they access supplier and merchant portals without shared credentials or manual human login. Separately, Visa has put Commercial Payment Controls into production for eligible issuers in supported regions, allowing businesses to set limits and restrictions on corporate spending. The company plans general availability of Commercial Virtual Authentication and Commercial Supplier Validation in 2027 after pilot completion. Its SESA 2.0 analytics platform has identified more than $600 billion in potentially cardable supplier spend. The pilot tests whether approved invoice payments can be executed through automated workflows while preserving buyer-defined controls.
Mastercard and Visa are advancing different approaches to AI-initiated business payments. At Cloudflare Connect, Mastercard demonstrated an agent making nine payments across multiple service providers under one authorized budget. It also opened early developer access to Agent Pay APIs, a sandbox and toolkits. Visa expanded its commercial agentic suite around a BILL and Billtrust pilot, alongside spend analytics and fraud tools. The distinction is how each approach constrains the agent. Visa’s pilot lets an agent pay invoices that buyers have already approved, using its Trusted Agent Protocol to navigate supplier-portal security without sharing underlying login credentials. Mastercard is testing controls for machine-to-machine transactions, including signed vouchers, agent verification and a score intended to estimate whether an incoming transaction was AI-initiated. Both efforts leave a consequential question for business payments: how responsibility should be assigned when an authorized agent follows its technical instructions but breaches a procurement condition.
Mastercard opened developer APIs, SDKs and a sandbox for Agent Pay for Machines (AP4M) on October 21, 2026. The tools enable autonomous AI agents on Amazon Bedrock to make multi-merchant micropayments over x402 using off-chain signed vouchers. The launch follows Coinbase Developer Platform’s report that cumulative x402 payments across Base and Solana had exceeded 100 million by October. The x402 protocol uses an HTTP 402 response to tell an agent what a service costs and how to pay. Its growing infrastructure includes a Linux Foundation-governed foundation, while alternative approaches use Lightning payments or existing processor rails. Transaction counts, however, do not establish how much genuine agent-led commerce is taking place. TRM Labs found a much smaller pool of plausible commercial trade after screening out other activity. Security questions also remain, including whether a service can receive payment without delivering its output. Developers therefore face choices about settlement, spending controls and proof of service.
CapitalOS completed a $21.9 million Series A financing round on October 21, 2026, led by LGVP. The company plans to expand its engineering team and scale the infrastructure behind its AI-driven money orchestration platform. WEX Venture Capital, Group 11, Great North Ventures, Night Capital and existing early investors also participated. Founded in 2022, CapitalOS helps vertical SaaS and AI platforms offer embedded charge cards, digital wallets and automated bill payments without maintaining in-house licensing or risk operations. Its architecture uses five specialized AI agents across underwriting, capital, compliance, risk and fraud, and support. Property management platform Guesty is an active customer, and CapitalOS reports managing transactions for more than 25,000 active cardholders across dozens of integrated platforms. CapitalOS relies on infrastructure provider Increase and its chartered partner banks rather than replacing depository institutions. The announcement did not disclose a valuation, credit warehouse partner or the identities of its current primary sponsor banks.