Agent payment protocols compared: x402, AP2, ACP, Visa, Mastercard and Qatom

Agent payment protocols compared: what does each one do?

Six names come up whenever people talk about AI agents paying for things. They overlap less than it seems. Some move money, some prove what the user allowed, and some tell a merchant which agent is calling.

With agent payment protocols compared in one table, the split becomes clear. Sources for each system are linked further down the page.

Why are there so many agent payment protocols?

Agent commerce has several jobs to do, and each protocol picked one or two. An agent has to find a seller, prove who it is, show what its user allowed, pay, and get a record of the payment. IDC projects agent tasks growing from 44 billion a year in 2025 to 415 trillion by 2030, so every part of that chain is getting attention.

The Model Context Protocol (MCP) sits underneath many of these. It connects AI assistants to tools and data, and remote servers authorize with OAuth 2.1. MCP itself has no payment step, so any paid tool needs a payment layer on top. For the bigger picture, read what agentic payments are.

What is x402?

x402 is an open payment protocol created by Coinbase and announced on May 6, 2025 with AWS, Anthropic, Circle and NEAR. Since April 2, 2026 it has been governed by the x402 Foundation under the Linux Foundation, whose premier members include AWS, American Express, Cloudflare, Coinbase, Google, Mastercard, Shopify, Stripe and Visa. It revives the HTTP 402 "Payment Required" status code.

The flow has four parts:

1. The client requests a resource, and the server answers 402 with the price and the tokens it accepts.
2. The client signs a payment and retries the request with an X-PAYMENT header.
3. A facilitator verifies the payment and settles it onchain, in stablecoins such as USDC on chains such as Base.
4. The server returns the data with an X-PAYMENT-RESPONSE header.

x402 fits API sellers who want payment inside the HTTP request itself and buyers who already hold stablecoins.

x402 in 2026: what the independent evidence shows

In 2026, analysts and security researchers published the first independent measurements of x402. Their findings matter for anyone choosing a rail:

• Real volume is a fraction of raw counts. A Visa and Artemis analysis put adjusted volume at roughly $15 million across about 109.6 million transactions through April 21, 2026, an average of about $0.14 (Forkast). TRM Labs counted 198.9 million settlements worth about $52.7 million, of which $25.62 million looked like real commerce, and estimated that 0.6% to 7.5% of that came from AI agents (Decrypt).
• Facilitators had security gaps. A July 2026 study, accepted to USENIX Security 2026, tested 15 major x402 facilitators covering about 99% of observed x402 transactions. It found 49 security-rule violations, which mapped to 31 previously unknown vulnerabilities, including ways to get a service without paying, and every facilitator violated at least one of its eight rules (arXiv 2607.19545; USENIX).
• Payment and delivery are separate. Verifying a payment does not lock the funds, and the seller usually delivers before settlement. The A402 paper says x402 "fails to enforce end-to-end atomicity across service execution, payment, and result delivery."
• No one owns disputes. There is no built-in dispute process, and a refund is a new transfer.

The fair counterpoints: the security findings were disclosed responsibly and the affected parties, including Coinbase, adopted mitigations. Artemis expects the share of gamed activity to fall as teams move to production (CoinDesk). And the fix Four Pillars proposes, accountable operators that settle before delivery and handle disputes, builds on the open standard rather than replacing it. The full picture is in x402 in 2026.

What is AP2 (Agent Payments Protocol)?

AP2 is an open protocol from Google, announced on September 16, 2025. More than 60 merchants and financial institutions back it, including Mastercard, American Express and PayPal.

AP2 is about proof of consent. It uses signed "mandates." An intent mandate records what the user allows the agent to look for and spend. A cart mandate records approval of a specific purchase. If the intent mandate is detailed and includes price limits, the agent can buy without asking for a second approval.

x402 vs AP2: what is the difference?

x402 answers "how does this request get paid?" AP2 answers "what did the user allow, and can we prove it?" They sit at different layers.

They also work together. AP2 has a crypto extension that integrates x402, so an AP2 mandate can authorize a purchase that x402 then settles in stablecoins. If you are weighing x402 vs AP2, the real question is whether you need a payment rail, a consent record, or both.

What is the Agentic Commerce Protocol (ACP)?

The Agentic Commerce Protocol is an open standard co-developed by Stripe and OpenAI, announced on September 29, 2025 under the Apache 2.0 license. The spec is published at agenticcommerce.dev.

ACP powers Instant Checkout in ChatGPT. The payment provider passes the merchant a scoped, logged payment token, and the payment runs on card rails. It suits merchants who sell goods and want to be bought from inside ChatGPT.

Agentic Commerce Protocol vs AP2

Both are open, and both came out in September 2025. ACP defines a checkout: the conversation between agent, merchant and payment provider that ends in a paid order. AP2 defines the authorization: signed mandates that prove the user approved the search, the spend or the specific cart.

In practice, ACP is tied to a live surface, Instant Checkout in ChatGPT, with Stripe as a co-author. AP2 has 60+ merchants and financial institutions behind it and a crypto path through x402. A merchant focused on ChatGPT buyers will look at ACP first. A merchant that needs a signed consent record will look at AP2.

Visa Intelligent Commerce vs Mastercard Agent Pay

Both card networks announced agent programs in 2025, and both run on card rails.

• Visa Intelligent Commerce comes with the Trusted Agent Protocol. It covers how agents identify themselves to merchants and how merchants verify them.
• Mastercard Agent Pay issues "agentic tokens" bound to a specific agent. Each token carries who authorized it.

The difference in focus is identity versus credentials. Visa's approach helps a merchant decide whether to trust the agent at the door. Mastercard's approach ties the payment credential itself to the agent and its authorizer. For merchants who already accept cards, both extend familiar infrastructure to agents.

Where do card rails stop working for agents?

Card rails work well for buying physical goods at a checkout. They struggle with small payments. Stripe's standard US online price is 2.9% + 30 cents per successful domestic card transaction.

That arithmetic is why ACP, Visa and Mastercard fit checkout-sized purchases, and why per-call API pricing needs a different rail. The micropayments guide covers this in more depth.

What are the x402 alternatives for per-call payments?

If you want to charge per request without card fees, the x402 alternatives in this list split two ways. The card-based options add card fees on every call. Full-stack platforms handle money movement, discovery and records for you, and Qatom is one of these.

Qatom is a turn-key agentic commerce platform. Your APIs, data and services become catalog items ("storefronts") that AI agents discover, order from and pay for. Money inside Qatom is USD-TDN, a US-dollar token (1 USD-TDN = 1 USD), and RBC holds the reserve funds backing it.

Here is how it compares on the points that matter for per-call pricing:

• Settlement: x402 and AP2's crypto path settle on a public blockchain with stablecoins. Qatom settles USD-TDN between wallets called twins, with no gas and no public ledger. qatom.ai states settlement in under one second.
• Fees: Qatom has a 0% platform take rate and charges no transaction fees, so cost does not scale with payment value or volume. See plans and pricing.
• Price floor: items can cost as little as 0.001 USD-TDN per call, or 0 for free (create a catalog item).
• Receipts: each purchase returns a transaction id and an emailed receipt. Twins are built on the TODA file protocol, so a receipt can be checked anywhere.
• Buyers: any MCP client connects to the Qatom master MCP, and storefronts are discoverable in the assistants and channels listed on qatom.ai.
• Control: purchases under an auto-approve limit go through; larger ones wait for your approval.

The trade-off is scope. Qatom is a platform you sign up to, with plans from Builder (free) to Enterprise. x402 is an open protocol you implement yourself.

Which agent payment protocol should you use?

Once you have the agent payment protocols compared, start from what you sell and where your buyers already are. These approaches can complement each other, so you may end up with more than one.

• You sell physical goods and want ChatGPT buyers: ACP, through Instant Checkout.
• You need proof of what the user approved: AP2 mandates, with x402 if you want the crypto path.
• You already take cards and want to recognize agents: Visa Intelligent Commerce or Mastercard Agent Pay.
• You run an HTTP API and your buyers hold stablecoins: x402, with a facilitator that has adopted the 2026 security fixes, settlement before you deliver, and a plan for refunds.
• You sell APIs, data or services per call and want catalog, discovery, wallets, approvals and payouts in one place: Qatom.

To make the call, work through these steps:

1. Write down your typical price per sale. Below a dollar, rule out card-only rails.
2. List where your buyers' agents run: ChatGPT, another assistant, or any MCP client.
3. Decide whether you need a signed consent record, a payment rail, or both.
4. Check what each option asks of you: implementing a spec, joining a card program, or signing up to a platform.
5. Ask how each option handles a payment that fails after delivery, and a refund or dispute.
6. Run one real test purchase end to end before you announce anything.

If you are a buyer setting rules for your own agent, read how to let an AI agent make purchases safely.

Next steps

• Sell your first item per call: how to monetize an MCP server.
• Read the developer docs for the Payment Node SDK and HTTP API v4 at docs.qatom.ai.
• Talk to the team about your use case on the contact page.