Cloudflare and Coinbase launch the x402 Foundation for machine-to-machine payments

Cloudflare and Coinbase are teaming up to launch the x402 Foundation, an effort to drive adoption of the x402 protocol — an open framework that lets clients and services exchange value over the web in a standardized way. Alongside the partnership announcement, Cloudflare is shipping x402 support in the Agents SDK and its MCP integrations, and is proposing a new deferred payment scheme for the protocol.

Why the web needs a payment protocol for agents

Today's payment flows were built for humans: browse a site, add to cart, enter a credit card, confirm. But as digital services increasingly need to transact directly with each other, the web lacks a common way for machines to pay machines. Cloudflare alone sees over a billion HTTP 402 "Payment Required" responses sent daily to bots and crawlers — yet those responses often go nowhere because there is no agreed-upon format for conveying payment terms. The x402 protocol aims to fill that gap with an open specification for websites and automated agents to negotiate payments programmatically.

How x402 works

  1. A client tries to access a resource protected by x402.
  2. The server responds with 402 Payment Required plus payment instructions in the response body, including the amount and recipient.
  3. The client re-requests the resource with a payment authorization header.
  4. A payment facilitator verifies the client's payload and settles the transaction.
  5. The server returns the requested resource with a payment response header confirming the outcome.

This design gives clients and servers a way to transact without accounts, subscriptions, or API keys. The use cases go beyond conventional monetization: an assistant buying Halloween costume accessories from multiple merchants, an AI agent paying per browser rendering session instead of a monthly subscription, or an autonomous stock trader making micropayments for a real-time data feed. Future versions of x402 could support credit cards and bank accounts alongside the current stablecoin rails.

A deferred payment scheme for high-volume crawlers

Agents and crawlers often need two things that are standard in financial infrastructure: delayed settlement to handle disputes, and batched payments for simpler accounting. Cloudflare's pay per crawl private beta is a case in point — participants crawl large numbers of pages, generate audit logs, and settle one daily fee via a connected card or bank account.

To support these scenarios, Cloudflare is proposing a deferred payment scheme as an addition to x402. The scheme targets agentic payments that don't require immediate settlement and can ride traditional rails or stablecoins. The key idea is to decouple the cryptographic handshake from settlement itself, so compliant servers can choose to work with pre-negotiated licensing agreements, batch settlements, or subscriptions. Cloudflare will bring this deferred scheme into pay per crawl as the beta expands.

The proposed handshake

The initial proposal for the next major x402 version uses a new deferred scheme in four steps:

1. The server's offer. An unauthenticated client hits a gated resource and receives 402 Payment Required with a machine-readable payment commitment payload the client can use to build a re-request.

HTTP/1.1 402 Payment Required
Content-Type: application/json

{
  "accepts": [
    {
      "scheme": "deferred",
      "network": "example-network-provider",
      "resource": "https://example.com/page",
      "...": "...",
      "extras": {
        "id": "abc123",
        "termsUrl": "https://example.com/terms"
      },
    }
  ]
}

2. The client's signed commitment. The client re-sends the request with a signed payload containing its payment commitment. The deferred scheme uses HTTP Message Signatures with a JWK-formatted public key hosted in a directory. The Signature-Input header lists which request parts the Signature covers, giving the server cryptographic proof of intent without requiring an on-chain transaction.

GET /path/to/resource HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 Chrome/113.0.0 MyBotCrawler/1.1
Payment:
    scheme="deferred",
    network="example-network-provider",
    id="abc123"
Signature-Agent: signer.example.com
Signature-Input:
    sig=("payment" "signature-agent");
    created=1700000000;
    expires=1700011111;
    keyid="ba3e64==";
    tag="web-bot-auth"
Signature: sig=abc==

3. Successful response. The resource server validates the signature and returns content with a confirmation header. The server maps the payment to the account linked with the HTTP message signature, verifying identity before delivering content — no blockchain involved at this stage.

HTTP/1.1 200 OK
Content-Type: text/html
Payment-Response:
    scheme="deferred",
    network="example-network-provider",
    id="abc123",
    timestamp=1730872968

4. Payment settlement. The validated id from the handshake becomes the transaction reference, so the server can settle flexibly — rolling payments up by subscription, daily, or in batches. Cryptographic trust is established immediately while financial settlement can route through traditional rails or stablecoins.

Live x402 tooling

Agents built with Cloudflare's Agents SDK can now pay for resources with x402, and MCP servers can expose paid tools. To demonstrate, Cloudflare built the x402 playground, a live demo on the Agents SDK with access to MCP servers deployed on Cloudflare.

image1

Opening the playground creates a wallet funded with Testnet USDC on a Base blockchain testnet. The agent has access to an MCP server with both free and paid tools.

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { McpAgent } from "agents/mcp";
import { withX402 } from "agents/x402";

export class PayMCP extends McpAgent {
  server = withX402(
    new McpServer({ name: "PayMCP", version: "1.0.0" }),
    X402_CONFIG
  );

  async init() {
    // Paid tool
    this.server.paidTool(
      "square",
      "Squares a number",
      0.01, // Tool price
      {
        a: z.number()
      },
      {},
      async ({ number }) => {
        return { content: [{ type: "text", text: String(a ** 2) }] };
      }
    );

    // Free tool
    this.server.tool(
      "add-two-numbers",
      "Adds two numbers",
      {
        a: z.number(),
        b: z.number(),
      },
      async ({ a, b }) => {
        return { content: [{ type: 'text', text: String(a + b) }] };
      }
    );
  }
}

When the agent invokes a paid tool, the MCP server answers with 402 Payment Required. The agent interprets the payment instructions and asks the human whether to proceed. Building an x402-compatible client takes a basic wrapper around the tool call:

import { Agent } from "agents";
import { withX402Client } from "agents/x402";

export class MyAgent extends Agent {
  // Your Agent definitions...

  async onToolCall() {

    // Build the x402 client
    const x402Client = withX402Client(
      myMcpClient,
      { network: "base-sepolia", account: this.account }
    );

    // The first parameter becomes the confirmation callback.
    // We can set it to `null` if we want the agent to pay automatically.
    const res = await x402Client.callTool(
      this.onPaymentRequired,
      {
        name: toolName,
        arguments: toolArgs
    });
  }
}

The agent draws funds from the wallet and sends the payment payload to the MCP server, which settles the transaction. Transactions can be configured to require human confirmation or execute autonomously, depending on the application.

Getting involved

Developers can start today with the Agents SDK or by deploying their own MCP server. Cloudflare and Coinbase will continue working on the x402 Foundation's structure, with more details to come. The protocol is open for contributions on GitHub, and the Cloudflare team can be reached at [email protected].