The HTTP error code 402 has been reserved for “Payment Required” errors since the mid-1990s. However, this code went unimplemented and largely abandoned until 2025. In May 2025, Coinbase implemented the error code through the x402 protocol, allowing AI agents and autonomous systems to require and negotiate payments via stablecoins for access to online content. Since the error code was unlocked, it has also been adopted by other major tech companies, including Cloudflare.
How x402 Works
The x402 protocol is designed to allow micropayments for access to online content. Its payment flow is broken up into four main steps:
Request: An agent performs a request for a piece of content
402 Response: The server sends a response with a 402 error code, indicating that payment is required and specifying the payment terms.
Payment: The agent makes the required payment using stablecoins.
Retry: The agent attempts to access the resource again, while including proof of payment via the X-PAYMENT HTTP header.
This protocol leverages blockchain technology to allow instantaneous, ad hoc payments for web-based resources. This eliminates many of the traditional sources of friction in accessing paid content, such as the need to set up an account with a paid service or to work with a centralized payment provider.
x402 Use Cases
The x402 protocol allows payment to be required for access to any web-based resource. Some key use cases for the technology include:
API Monetization: With the x402 error code, APIs can be monetized without subscriptions or API keys. Instead, API endpoints can send an HTTP 402 error detailing payment requirements in response to user requests.
Agent-to-Agent Micropayments: The x402 protocol is also designed to support the growing agentic economy. Agents can easily set up payment pages and accounts to receive payments from one another as needed.
Pay-Per-Use Resources: This protocol also offers the potential for users to offer access to compute, content, and other resources on a pay-per-use basis. Users could specify required quantities in a request, receive a 402 error detailing terms, and send another request with proof of payment.
Cross-Border Payments: Blockchain technology — and stablecoins in particular — have become extremely popular for cross-border payments and settlements. This protocol offers another way to implement this, as payment pages can be set up to negotiate and receive crypto payments.
Key Security Considerations for x402 Micropayments
The x402 protocol leverages stablecoins to implement web micropayments at the speed of the Internet. However, it does introduce certain security risks if not implemented properly, including:
Payment Replay: The x402 process involves sending a second request containing proof of a valid payment. If the server isn’t configured to make these proofs single-use, then an attacker might be able to access a resource multiple times with the same payment. To prevent this, servers should include unique nonces for each payment and short expiry deadlines.
Payment Interception: On-path attacks — also known as Man-in-the-Middle (MitM) attacks — involve an attacker intercepting and modifying web traffic. For x402, this could include changing the payment data in a 402 error or the requested resource in a 402 request with valid payment to benefit the attacker instead. To prevent this, servers should implement strict enforcement of HTTPS/TLS, including HSTS and certificate pinning, and payload signing and integrity verification.
Centralization Risks: Facilitators are an optional role in the x402 protocol that allows a third party to handle the complexity of interacting with the blockchain and managing payment verification. However, this introduces potential centralization risks if a facilitator is compromised or implements censorship. This can be prevented by using multiple facilitators or directly performing verification of on-chain transactions.
Prompt Injection: The x402 protocol is designed to support the agentic economy, allowing autonomous systems to perform micropayments. Prompt injection attacks introduce the risk that agents might send payments to attacker-controlled wallets, respond to fraudulent payment requests, or take other undesired actions. All 402 responses should undergo input validation before agents process them.
Overpayment and Draining: A malicious 402 page could be used to trick an autonomous agent into paying more than intended for a particular resource. To mitigate this risk, agents should have hard spending limits, allowlists for trusted payees, and human-in-the-loop approvals for high-value transactions.
Smart Contract and On-Chain Risks: The x402 protocol depends on stablecoin payments, which introduces Web3 security risks. For example, smart contracts may have exploitable vulnerabilities, and front-running attacks may impact the intended logic of pages using the protocol. Smart contract security audits and on-chain monitoring are critical to managing these potential security risks.
Privacy and Linkability: On-chain ledgers are designed to be transparent, allowing anyone to look up a transaction on-chain. This has privacy implications for the x402 protocol since someone could theoretically map out all of the transactions performed by a user and the associated content that they were accessing. Single-use addresses and similar tools can help to break up these chains and enhance privacy.
In addition to these technical and security risks, the x402 protocol also faces issues related to governance and standardization. While Coinbase has defined x402 as an open-source protocol, there is no IETF RFC to date. As a result, it’s possible that multiple conflicting implementations could emerge, causing fragmentation.
Securely Implementing the x402 Protocol
The x402 protocol dramatically reduces potential friction for monetizing online resources. Instead of requiring users to set up a paid account before accessing content, API endpoints and other resources can send an HTTP error code indicating the need for payment and a mechanism for doing so. This protocol supports not only human users but also AI agents that will need to be able to perform micropayments at machine speed.
However, the x402 protocol carries certain security risks if implemented incorrectly. When designing and implementing clients and servers using the protocol, it’s vital to implement Web2 and Web3 security best practices to mitigate these potential threats.
Halborn has extensive experience in Web2 and Web3 security and can help organizations to securely implement x402 through advisory services and code security audits. Get in touch to find out more.