When the authors of HTTP wrote down the list of status codes in the late 1990s, they left one of them empty on purpose. Code 402, "Payment Required," ships in every web server and browser you have ever used, sitting in the specification next to 404 and 500, and for close to three decades it did nothing. The current standard still describes it as "reserved for future use". The future finally showed up.
The mechanism now being built for machine-to-machine payments is old, but a payer finally arrived where a per-request paywall actually fits. Parts 1 and 2 laid out why the old way of paying for the web, ads and subscriptions, stops working when the reader is software that sees no ad and signs up for nothing. This is the first of the replacements. It is also the one most likely to be oversold, so the second half of this post is spent taking the headline numbers apart.
The status code that waited for a use case
402 was reserved in the HTTP/1.1 drafts and it stayed reserved through every revision since. The reason it lay dormant is not mysterious. A status code is only half of a payment. The other half is a way to move money, and the web never had one built in. Browsers shipped no native wallet. There was no standard for a server to quote a price a client could read.
Here is the place where blockchain comes in. What changed recently is that stablecoins gave software a way to hold and send small amounts of value without a card account, and AI agents gave the web a payer for whom "pay a fraction of a cent per request" is a sensible unit. A per-call charge that no human would bother to pay is exactly the shape of a bill a machine can pay thousands of times an hour without noticing.
The handshake, in one round trip
The protocol getting the most traction here is x402, originated by Coinbase and worked on since by Cloudflare, Stripe, and others. Strip away the branding and it is a small, legible exchange between three roles: the client (the agent that wants something), the resource server (the endpoint that has it), and a facilitator, a service that checks and settles the payment so the resource server never has to touch a blockchain itself.
The client asks for a resource. The server, instead of serving it, answers 402 and attaches, in a response header, what it costs and how to pay. The client constructs a signed payment and repeats the same request, this time carrying that payment in a request header. The server hands the payment to the facilitator to verify and settle, and only then returns the resource with a normal 200 response.
There is no account, no signup, no session: the payment travels with the request, and a client that has never been seen before can pay on its first call. The exact header names have shifted between the protocol's first version in May 2025 and the v2 revision that followed in December, which is a fair sign of how young this is.
Why machines want different rails than cards
The obvious objection is that we already have payment rails, and they work. Cards clear trillions of dollars a year. Why reach for stablecoins and on-chain settlement for a machine when Visa exists?
The strongest version of the answer comes from a16z crypto, in a piece arguing that agentic commerce won't kill cards but will open a gap alongside them: cards are built for a knowable customer a bank has underwritten, and an autonomous agent with no account or credit history is precisely the customer that system is designed to refuse. Instant, final settlement removes the merchant's fraud exposure, which is what makes serving an unvetted counterparty worth it. Banks back humans who are their vetted clients. They don't back strangers made of software.
The honest risk list
Instant, final settlement means no chargebacks. With a card, a wrong or fraudulent charge is a dispute you file and usually win. With a stablecoin payment that has settled on-chain, the money is gone, and there is no intermediary with both the authority and the incentive to reverse it.
That moves the whole security burden onto the thing holding the keys. An agent authorized to pay is an agent authorized to spend your money. A prompt injection that convinces an agent to buy something, a bug in a spending loop, a compromised dependency in the agent's toolchain: each of these now costs you whatever the agent could pay before someone notices. Spending caps, short-lived keys, and a human approving anything above a threshold are the obvious mitigations, and they are exactly the controls the more serious implementations lead with. They also, tellingly, describe bounded autonomy rather than the full autonomy the pitch implies.
Is anyone actually using it?
Chainalysis counted more than 100 million x402 transactions on Base through the first quarter of 2026. Left there, that number implies a thriving machine economy. It isn't one, at least not yet. When Artemis went through the flow, roughly half of those transactions were self-dealing or wash trading (value moved in a loop to make the activity look larger than it is), and the genuine economic volume was tiny: on the order of $28,000 a day, at an average payment near twenty cents. So the honest reading is that the transaction count is large, mostly hollow, and the real spending underneath it is small enough to fit in a rounding error of the card networks it's compared to.
The examples make the point concrete. A memecoin called PING ran a pay-to-mint scheme through an x402 flow and racked up more than 150,000 transactions in its first month, activity that inflates every headline count while telling you nothing about agents buying anything useful.
Over the same period, the share of x402 transactions worth at least a dollar rose from about 49% to about 95%. That is a good sign: the protocol is being used for real economic activity, not just to make a number look big. But it also shows that the average transaction size is still tiny, and that the total volume is still small enough to be dwarfed by a single day's card payments at any large merchant.
A primitive, not a product
The clearest sign that this is settling into infrastructure rather than a single company's play is governance. In April 2026 the x402 protocol moved to the Linux Foundation as a vendor-neutral project, with Coinbase as originator and Cloudflare and Stripe among the early collaborators. That is roughly the trajectory a low-level standard should follow if it's going to become plumbing: start inside one company, get useful, then get handed to a neutral body so nobody owns it and everyone can build on it.
But a settlement rail is only the mechanism for moving money once a price exists. It says nothing about what the price should be, who sets it, or what the buyer is even allowed to do with what they paid for. A machine can now pay you a fraction of a cent for a request. Whether that fraction of a cent is the right charge, whether you should be billing per request at all or per unit of value the request creates, is a separate question.
This is Part 3 of The Machine Web, a series on what changes when the web's main character stops being human.
Part 1: The Machine Web Part 2: The reader isn't human anymore
AKENA is a blockchain engineering studio. We build the infrastructure AI agents run on: agent-facing RPC and MCP endpoints, on-chain data pipelines, and the payment and metering layers that sit in front of them. If you're working out how to charge a machine for what it asks of you, we should talk.