Agent Payments Explained: x402, MPP, Visa, Mastercard and the Wallets

November 15, 2026 / Arvid Andersson

When we added agent payments as a category on Infrabase in October it had two products. It now has around a dozen, plus a set of protocols with confusingly similar names. Give an agent money and two questions come up fast: how does it pay a service built for humans? And how much is it allowed to spend? This post is the map I wanted when I started reading up on it.

TLDR

• Paying per API call: x402 and MPP. The API answers "402, that's $0.005", the agent pays in stablecoins and asks again.
• Paying a shop with a card: Visa's and Mastercard's agent programmes, which you reach through a wallet or payment provider.
• Selling to agents: checkout protocols like ACP and AP2.
• What you actually integrate: a wallet or card product that holds the money and enforces your limits.

Paying per request: x402 and MPP

HTTP has had a status code for this since 1997: 402 Payment Required, reserved "for future use". x402 and MPP finally use it. The flow is simple:

1. The agent calls an API.
2. The server answers 402 with a price.
3. The agent pays and sends the same request again with proof of payment.
4. The server returns the response.

No account with the seller, no API key, no invoice. For an agent that needs one answer from a service it has never used before, that matters a lot.

x402 started at Coinbase. Since 14 July 2026 it lives in the x402 Foundation at the Linux Foundation, which launched with 40 member organisations (Adyen, AWS, Cloudflare, Google and Mastercard are among the premier members). Payments settle through a facilitator. Coinbase runs one that is free for the first 1,000 onchain transactions a month and $0.001 per transaction after that. Coinbase says it has processed more than 100 million transactions.

MPP (Machine Payments Protocol) is Stripe and Tempo's take on the same idea. It launched on 18 March 2026 and the core spec has been submitted to the IETF. It adds sessions: deposit once, then pay per request off-chain. It also treats cards and Lightning as payment methods next to stablecoins. mpp.dev lists MPP endpoints for Anthropic, OpenAI, fal.ai and Parallel. The two protocols are converging more than competing; MPP's tooling can serve both on the same endpoint.

The thing to think through is settlement. It is mostly USDC and it is final. There are no chargebacks; a refund means the seller sends money back. For a fraction-of-a-cent search call that is fine. For an agent with access to real money it means your limits are the safety net.

Paying with a card: Visa and Mastercard

Most of the internet still takes cards, not USDC. Visa and Mastercard both run programmes that give an agent a tokenized card instead of the real number:

• Visa Intelligent Commerce gives an agent tokenized credentials plus purchase instructions the cardholder approved. Visa's Trusted Agent Protocol lets a merchant check that a request comes from an approved agent.
• Mastercard Agent Pay issues tokens to registered agents. On 10 June 2026 Mastercard added Agent Pay for Machines, aimed at frequent, small machine-to-machine payments.

You can't just sign up for either. Visa requires approval as a participant plus onboarding to its token service, passkeys and certification before you reach production. In practice you get there through a wallet or payment provider that has already done that work. Neither network publishes fees. What you keep with cards is reach (any merchant that takes cards) and the usual dispute rights.

Selling to agents: ACP and AP2

These are for the other side of the counter: a merchant that wants agents to buy from it. If you are building an agent rather than a store, you will mostly meet them through your payment provider.

• ACP (Agentic Commerce Protocol), from OpenAI and Stripe, lets an agent complete a purchase in a merchant's checkout with a payment token. The merchant stays merchant of record. OpenAI's commerce docs now lead with product feeds and payments on the merchant's own site, with no ACP checkout spec in the index. Worth watching where that goes.
• AP2 (Agent Payments Protocol), from Google, records what a user authorised as signed mandates that a merchant or card issuer can check later. Google donated it to the FIDO Alliance on 28 April 2026, together with Verifiable Intent, which it co-developed with Mastercard.

The protocols side by side

What you integrate: wallets and spend controls

The protocols say how an agent pays. The products decide whether it may. They hold the money or the card, enforce the limits and give the agent a tool to call, usually over MCP. They mostly differ in what the agent pays with (bank money, stablecoins or a card) and in how you set limits. Here are the products in the category on Infrabase right now:

Starting prices come from each listing on Infrabase, read off the vendor's own pricing page.

What to think about before you pick

1. What is the agent buying? API calls and data at fractions of a cent suit x402 or MPP. Goods from ordinary online shops need a card: an agent card with limits, or a vault that fills the user's card into checkout.
2. Who carries the risk when it goes wrong? Stablecoin payments are final. Cards keep dispute rights. With final settlement your limits are the protection. Set them before the first payment goes out.
3. How do you set limits? The products do this differently: a mandate with an amount, expiry and purchase count (Nevermined), policies with human approval (Catena), a per-call maximum and a run budget (Locus) or card limits (Crossmint). I think budgeting per run beats budgeting per call. An agent that rephrases a search and tries again pays again.
4. Will the site let the agent in? Plenty of sites block automated traffic long before payment comes up. Identity tokens like Skyfire's KYA and Visa's Trusted Agent Protocol exist to fix that. Check that the sites your agent needs actually accept them.
5. Does it plug into your agent? Most of the products above offer a hosted MCP server, a CLI or an SDK. If your agent calls paid APIs, check which ones can pay x402 and MPP endpoints.
6. Where does it work? Some products run on US banking only. Crossmint has an entity in Spain licensed under MiCA and PSD2. Worth checking early if you build for EU users.
7. Are you buying or selling? If you sell an API to agents, start from the seller side of x402 or MPP: middleware that answers 402 and checks the payment.

This space moves fast. Treat this post as a snapshot. Prices and statuses were read off each vendor's own pages on 15 November 2026. If something is out of date, email hi@infrabase.ai and we'll fix it.

FAQ