The mismatch

An API key is a long-lived secret. Whoever holds it can run up the bill. The provider has to verify a human signed up, took the ToS, attached a card. Then the human has to rotate that key when it leaks. Then they have to share it with each agent they want to act on their behalf, hope the agent stores it safely, and trust that nothing in the agent's runtime logs it.

Now run that through 30 different APIs. Each one needs its own signup, its own dashboard, its own monthly invoice, its own rotation policy. Your agent has zero state going in and 30 dashboards going out.

This worked when humans were the bottleneck. Agents aren't humans.

What 402 says instead

HTTP 402 Payment Required has been reserved in the spec since 1997 and never had an obvious use. x402 gives it one: the server says "this costs $X, signed to this address, on this chain", and the client signs a one-shot USDC transferWithAuthorization for exactly that amount and replays the request. 

POST /v1/secrets-exposure-check
→ 402 { price: "0.02", chain: "base", payTo: "0x8f5c..." }

POST /v1/secrets-exposure-check
X-PAYMENT: <base64(signed-authorization)>
→ 200 { score: 73, findings: [...] }

No account. No key. The agent's wallet is the identity. The signature authorizes exactly this one charge. If the agent is compromised, the blast radius is whatever USDC was on the hot wallet — not "every endpoint anybody ever signed up for".

What that buys you on the supply side

If you're the API provider, you stop running an auth system. No signup page, no email verification, no Stripe webhook, no dunning, no rate-limiter that depends on knowing which account is calling. The chain settles. You read the on-chain log if you want to know who called.

The economic gravity goes the other way too. Pricing per call at $0.001 lets an agent run a thousand probes for a dollar. Try doing that with a typical "starter plan: $99/mo, 10k requests included" SaaS. The 99-dollar floor was a tax on the auth system itself.

Who already does this

The Coinbase x402 spec landed in early 2025. By mid-2026 there are 244 endpoints in the agentutility portfolio alone, all settling on Base mainnet through one facilitator wallet. The endpoints range from $0.001 unicode normalization calls up to $0.30 image generations. Per-call. No subscription.

The MCP discovery layer matters here. An agent running Claude Code or Cursor adds the x402-deployer MCP and gets every endpoint in the catalog as a callable tool, with payment auto-handled. So "agent calls a paid API" stops being three integration tickets and becomes one install.

What it doesn't fix

x402 doesn't solve identity. The wallet that signed the payment is just an Ethereum address. Want to know it's "Acme Corp's customer-support agent"? You still need ERC-8004 or some equivalent agent registry, signed claims, KYC if the use case demands it. We register agentId 47167 on Base's ERC-8004 Identity Registry for exactly this reason. The card resolves to a verifiable description of what this entity does.

Also doesn't fix abuse. A bad agent can pay full freight and still be a bad agent — DDoSing your endpoint at $0.001 a request. Rate limiting still applies, just on a wallet basis instead of an API key basis.

Try it

Pick any endpoint on agentutility.ai. Hit it once with curl. You'll get the 402. The body of the 402 tells you exactly what to sign. Run that through viem or ethers, base64 the JSON, retry. That's it.

If the goal is to get one agent talking to ten APIs without standing up an account on any of them, x402 is the shortest path right now. The 402 status code finally has a job.