Two years ago, HTTP 402 was a status code nobody implemented. This September and October it became the centre of a land grab: Visa, Mastercard, Google, OpenAI, Stripe, Coinbase and Cloudflare have all shipped or standardised an agent-payment protocol, and several of them shipped something in the last ten days. If you build agents that pay for things, this is the map as it stands today — and a note on the one number the announcements all lean on.
We are a pay-per-call API marketplace that settles USDC on Base. That is one rail and one protocol out of seven. The rest of this post is the honest picture of where we sit in it, sourced line by line, including the parts that are not flattering to the on-chain side.
Visa — Trusted Agent Protocol (TAP). Pre-GA. Visa's own page says the product is "in the process of development and deployment" and features may not be in all markets. TAP is the merchant-side half of Visa Intelligent Commerce: signed, merchant- and purpose-specific, time-bound, non-replayable messages so a CDN or merchant can tell a Visa-trusted agent from a scraper bot. Verified data categories include Agent Intent, Consumer Recognition (including a crypto wallet address), and Payment Information (hashed Visa credential). It settles on card rails, not on-chain. Sample implementation: github.com/visa/trusted-agent-protocol.
Mastercard — Agent Pay for Machines (AP4M). Announced June 2026, targeting high-frequency, sub-cent machine payments across four capabilities (credentialing, permissioning, transacting, settlement), and explicitly multi-rail: cards, accounts, and stablecoins. 30+ launch partners include Cloudflare, Coinbase, OKX, Stripe, Polygon and the Solana Foundation. On September 30, 2026, Mastercard added trust and intelligence services — the first a "probability score" that a transaction was AI-initiated — built with Cloudflare and Skyfire.
Both card networks now say the quiet part out loud: the agent does not have to care which rail it is. Visa's front door, Intelligent Commerce Connect, is positioned as network- and protocol-agnostic and explicitly supports TAP, MPP, ACP and UCP.
Google — AP2. Donated to the FIDO Alliance in 2026 to stay platform-agnostic. v0.2.0 adds Human-Not-Present / autonomous payments and is still pre-release (0.x). It is the only one of the four major specs with a versioned release so far, and its reference samples include an x402 flow.
Google + Shopify — UCP (Universal Commerce Protocol). Announced at NRF in January 2026 with Shopify; founding council Google, Shopify, Etsy, Target, Walmart. Amazon, Meta, Microsoft, Salesforce and Stripe joined the Tech Council in April. OpenAI is absent. Discovery is via /.well-known/ucp; it uses AP2 for payments plus OAuth 2.0 identity linking and RFC 9421 HTTP Message Signatures.
OpenAI + Stripe — ACP. Released September 2025. Standardises discovery→checkout→payment for in-conversation buying with single-use, merchant-scoped Shared Payment Tokens. Instant Checkout was discontinued on March 4, 2026, after weak consumer interest (reportedly ~30 merchants); OpenAI pivoted to discovery plus merchant-owned checkout. ACP survives as plumbing for ChatGPT apps.
Coinbase / Cloudflare — x402. Open-sourced May 2025, transferred to the Linux Foundation; the x402 Foundation launched April 2, 2026 and reached ~40 members by July (Coinbase, Cloudflare, Stripe, Circle, Google, Microsoft, AWS, Visa, Mastercard, Shopify, Solana, Polygon). Block (Dorsey) joined on September 24, 2026, contributing Bitcoin and Lightning. Cardano was integrated into the official x402 SDK this quarter. And on October 1, 2026, the XRP Ledger passed 10 million x402 payments in under three months.
Tempo + Stripe — MPP (Machine Payments Protocol). Launched with Tempo mainnet on March 18, 2026. This is the one to watch if you care about interop: MPP formalises HTTP 402 as an IETF submission — the Payment HTTP Authentication Scheme, at paymentauth.org — and is rail-agnostic (Tempo stablecoins, Stripe cards and wallets via SPTs, a Visa card spec, Lightspark Lightning). Stripe's own post says Stripe supports both MPP and x402 but does not claim they interoperate; claims that MPP and x402 are compatible are third-party and we treat them as unverified.
10 million x402 payments on XRP Ledger is a real signal that the rail is being exercised. It is also the easiest number in the stack to grow and the least informative. A payment count is challenges answered, not value transferred, not distinct payers. XRPL's announcement gave no settled total and no payer count — at a near-zero fee, 10 million payments say how many times the rail ran, not how much money moved.
Independent on-chain analyses are blunter. TRM Labs put settled x402 volume at roughly $52.7M since May 2025, of which only about $25.6M was genuine, with agents accounting for between 0.6% and 7.5% of activity; Artemis estimated around half of observed activity as artificial. We have no stake in which of those is right — we cite them because a payment-count headline and a settlement-volume study point in different directions, and only one of them is on the press release.
The same discipline applies to us. On minia2a.uk/api/stats the biggest number is the one we tell you not to quote:
| Metric | Value (Oct 1, 2026) | What it means |
|---|---|---|
| Total requests served | 4,734,866 | Inflated. The field's own note says it counts bot polling and self-polls. Do not cite it as usage. |
| Real on-chain USDC | 225 transactions = 6.22 USDC | 193 settled pay-per-call + 32 legacy top-ups. Each verifiable on Base. This is the honest size of settlement. |
| Real adopting agents, 7d | 3 | Distinct HMAC(X-Agent-ID) — the identity we can actually attribute. Small, and published anyway. |
| Services listed | 1,694 | A catalogue count is a listing count. It is not a delivery count. |
The distance between the first row and the second is the point of the whole exercise. Any x402 platform — ours included — can grow its request counter by pointing a probe at its own catalogue. The numbers that resist inflation are the ones that cost money to produce.
If the rails converge — and the last two weeks suggest they are — then holding a rail stops being a moat. What stays hard is the half nobody demos: out of everything that will accept a 402, which endpoint do I call, at what price, is it still live, and did the payment return what was promised. That is discovery and delivery, and it is measured in successful deliveries, not in challenges answered.
A directory count of 1,694 services and a delivery-verification headline of "13 of 659 verified" (as one public x402 directory reports) describe the same industry. The gap between them is the work.
Sources: Visa Trusted Agent Protocol overview (developer.visa.com) and Visa Intelligent Commerce Connect (The Paypers, FintechNews.ch); Mastercard AP4M launch (investor.mastercard.com) and the Sept 30, 2026 trust/intelligence services (mastercard.com); Google AP2 spec (github.com/google-agentic-commerce/AP2) and AP2→FIDO (blog.google); UCP specification (ucp.dev) and Tech Council (ppc.land); OpenAI/Stripe ACP and the Instant Checkout wind-down (forkast.news); x402 Foundation / Block (thenewscrypto.com); MPP (stripe.com/blog/machine-payments-protocol, mpp.dev, corporate.visa.com); WebMCP (venturebeat.com); XRP Ledger 10M (coingape.com); Cardano x402 SDK (bingx.com); TRM Labs and Artemis figures (webpronews.com); directory verification ratio (dev.to/pennyforgehq). Our own figures are read live from minia2a.uk/api/stats and the field notes in that payload; no number here is estimated.