Three names come up whenever AI agents and payments are mentioned together: x402, AP2 and ACP. They are often lined up as rivals, but they answer different questions. x402 lets a server charge for a single request. AP2 gives a merchant proof that a person authorized what their agent is buying. ACP runs a checkout between an agent and a shop. All three changed in 2026, so this comparison is built from each protocol's own pages and repositories, read on October 17, 2026.
The short answer
| x402 | AP2 | ACP | |
|---|---|---|---|
| The question it answers | How does a server charge for one request? | How does a merchant know the person said yes? | How does an agent check out at a shop? |
| Started by | Coinbase, May 2025 | Google, September 2025 | OpenAI and Stripe, September 2025 |
| Looked after today by | The x402 Foundation, at the Linux Foundation | Google's repository, donated to the FIDO Alliance in April 2026 | OpenAI, Stripe and Meta |
| Money it moves | Mainly stablecoins, digital dollars such as USDC | Cards in its first version, with more on its roadmap | Cards |
| Where it lives | Inside HTTP: a 402 answer and three headers | Signed mandates, carried by a commerce protocol | Checkout endpoints run by the merchant, over REST or MCP |
| Is the person there? | Up to the client: the protocol needs only a signed payment | Either: present, or not present within limits they approved | Yes: they confirm each step |
| License | Apache 2.0 | Apache 2.0 | Apache 2.0 |
Each row is taken from the sections below, where every fact links to its source.
x402: a price on a request
Coinbase launched x402 on May 6, 2025, as a way to pay in stablecoins directly over HTTP, so that APIs, apps and AI agents can pay each other. AWS, Anthropic, Circle and NEAR were named as collaborators at launch (Coinbase).
How it works. A server that charges answers 402 Payment Required with a PAYMENT-REQUIRED header that lists what it accepts: the scheme, the network, the amount, the asset and the address to pay. The client signs a payment and sends the same request again with a PAYMENT-SIGNATURE header. The server checks and settles the payment, by itself or through a facilitator, and answers with a PAYMENT-RESPONSE header (x402 HTTP transport). Those three headers arrived with version 2, announced on December 11, 2025; the first version used X-PAYMENT (x402 V2, Coinbase). The same exchange is also defined for MCP, where the payment travels in a tool call's _meta field (x402 MCP transport).
What money. x402.org names stablecoin payments as the main use and says the protocol takes no fee of its own, while network fees still apply (x402). The version 2 announcement says facilitators for ACH, SEPA or card networks can fit the same model (x402 V2). The schemes the specification publishes today are exact, upto, batch-settlement and auth-capture (x402 schemes).
Who looks after it. The Linux Foundation launched the x402 Foundation on April 2, 2026, with Coinbase contributing the protocol; the foundation had been developed by Coinbase, Cloudflare and Stripe (Linux Foundation). Its operational launch followed on July 14, 2026, with 40 member organizations (x402 Foundation). The repository is licensed under Apache 2.0 (x402 repository).
Is the person there? The protocol asks the payer only for a signed payment (x402 specification). A client can ask its person before it signs, as the example agent in Cloudflare's x402 post does (Cloudflare).
What it leaves out. The x402 specification lists budget management on the client's side as out of scope (x402 specification). x402 says how to pay a price; how much an agent may spend is left to whoever runs the agent.
AP2: proof that the person said yes
Google announced the Agent Payments Protocol on September 16, 2025, developed with more than 60 organizations, and usable as an extension of the Agent2Agent protocol (A2A) and of MCP (Google Cloud).
What it is. AP2 describes itself as a security layer that works inside a commerce protocol. Product catalogs and the checkout APIs themselves are outside its scope (AP2 specification). What it adds is signed proof, for the merchant, the card issuer and the payment processor, that the person authorized the purchase.
How it works. The first version used an Intent Mandate and a Cart Mandate, signed as verifiable credentials (Google Cloud). Version 0.2, released on April 28, 2026, replaced them with two mandate types, a Checkout Mandate and a Payment Mandate, each either open (the person's limits) or closed (one exact transaction), signed as SD-JWTs (AP2 changelog, AP2 specification). An open Payment Mandate can carry limits such as an amount range, a budget and the payees allowed (AP2 Payment Mandate).
Is the person there? AP2 has two modes. With the person present, they see the final checkout and approve it. With the person not present, they approve a set of limits, and the agent assembles the final mandates within them (AP2 specification). Google introduced version 0.2 as the release with the updates for these autonomous, "Human Not Present" payments (Google).
What money. Google's announcement says AP2 supports cards, stablecoins and real-time bank transfers (Google Cloud). The protocol's own site is more careful: the first version supports cards, and bank transfers such as UPI and PIX, e-wallets and digital currencies are on the roadmap (AP2). The specification itself does not depend on any one way to pay (AP2 specification). Stablecoin payments came through a separate A2A x402 extension, launched with the announcement (Google Cloud).
Who looks after it. Google donated AP2 to the FIDO Alliance on April 28, 2026 (Google). The specification is still published in Google's repository, under Apache 2.0 (AP2 repository).
ACP: a checkout the merchant runs
OpenAI and Stripe released the Agentic Commerce Protocol on September 29, 2025, together with Instant Checkout in ChatGPT (OpenAI, Stripe). It is an open standard for checkouts between buyers, AI agents and businesses, under Apache 2.0, and works over REST or MCP (ACP).
How it works. The merchant runs the checkout: endpoints to create a checkout session, update it, complete it and cancel it (ACP checkout API). To pay, the payment provider issues a token for one purchase, limited to a maximum amount, one merchant and an expiry time (ACP delegated payment). Stripe's version is the Shared Payment Token, tied to one merchant and one basket total (Stripe). The merchant accepts or declines the order and charges it through its existing payment provider (OpenAI), and stays the merchant of record (Stripe).
Is the person there? Yes. In ChatGPT, people confirm each step before anything happens, and the payment token is only authorized for a specific amount and merchant (OpenAI).
What money. In the latest stable version of the specification, dated April 17, 2026, the delegated payment accepts cards only (ACP delegated payment). Stripe is the first payment provider that supports it (ACP).
Who looks after it. The repository lists OpenAI, Stripe and Meta as its lead maintainers (ACP maintainers). In March 2026 OpenAI said it was letting merchants use their own checkout pages while it focused on product discovery, and extended ACP to cover discovery (OpenAI).
Which one pays for what
- An agent paying for an API call, a page or a tool, one request at a time, with no account at the seller: x402.
- A shop selling to people's agents through a checkout it controls, paid by card: ACP.
- A merchant, issuer or processor that needs proof a person authorized a purchase, above all when the agent buys while the person is away: AP2, inside whichever commerce protocol carries the checkout.
They are not walled off from each other. Google launched the A2A x402 extension alongside AP2 to carry stablecoin payments (Google Cloud). Stripe co-maintains ACP and holds a seat on the x402 technical steering committee (ACP maintainers, x402 TSC), and Google is a premier member of the x402 Foundation (x402 Foundation).
What none of them decides: the agent's own budget
Each protocol limits a single payment in its own way: x402 by the price the server states, AP2 by the limits in a signed mandate, ACP by a token for one amount at one merchant. None of them decides how much money an agent has, how much it may spend in a day, who it may pay, or how its owner stops it. x402 leaves budgets out of scope by design (x402 specification).
That part belongs to whoever holds the money and approves the payment: the wallet or account the agent pays from, and the person who decides what it may spend.