Agentic Payment Protocols Compared: x402 vs AP2 vs ACP vs MPP

Short version: The four headline protocols are not four answers to the same question. x402 and MPP are machine payment protocols: an agent hits a paywall, pays, and gets the resource, usually in stablecoins over HTTP 402. AP2 is an authorization protocol: signed mandates that prove a user gave an agent specific authority, whatever rail settles the payment. ACP is a checkout protocol: it lets an agent complete a purchase inside a chat interface while the merchant keeps its existing payment processor. Underneath them, Visa's Trusted Agent Protocol answers "is this agent legitimate?" and Mastercard Agent Pay puts agent spending on tokenized card credentials. Most serious platforms support several of these at once, which is why the agentic payments hub tracks protocol support per provider instead of declaring a winner.

The comparison table

x402: the paywall protocol

x402 turns an API or digital service into a paid resource with no checkout page, card form or signup. The flow is deliberately small: the client requests a resource; the server responds with HTTP 402 and the price, recipient and accepted payment options; the client signs a payment and retries with proof attached; a facilitator verifies and settles; the server returns the resource with a payment confirmation.

Key facts, from x402.org and Coinbase's developer docs:

• The protocol is blockchain-agnostic: all EVM-compatible chains and Solana, with stablecoins as the primary use case and USDC the most common asset. Sellers can accept any ERC-20 token on EVM networks or SPL token on Solana.
• A facilitator can verify and settle on the seller's behalf. Coinbase's hosted facilitator validates signed payments, screens transactions (including OFAC and KYT checks), submits settlement onchain and reports back, so sellers need no blockchain infrastructure.
• Protocol fees are zero. Coinbase's facilitator is free for the first 1,000 onchain transactions each month, then $0.001 per additional transaction; payment verification is always free.
• Governance sits with the x402 Foundation, created by Coinbase and Cloudflare in September 2025.

Pick x402 when the buyer is software and the good is digital: API calls, data, inference, content. Its constraint is the flip side of its simplicity: it carries no identity or authorization model of its own, so platforms pair it with wallets and identity layers. Crossmint, Nevermined and Coinbase Agentic Wallet all build on it; see the best agentic payment platforms.

AP2: the authorization protocol

Google built AP2 (Agent Payments Protocol) to answer three questions that a payment rail cannot: Authorization (can you prove the user gave this agent this authority?), Authenticity (does this request reflect the user's true intent?), and Accountability (who answers for a fraudulent or wrong transaction?).

Its mechanism is the Mandate: tamper-proof, cryptographically signed digital contracts, signed by verifiable credentials.

• An Intent Mandate captures the original instruction. In delegated, human-not-present tasks the user signs it upfront with price limits, timing and conditions, as pre-authorized proof.
• A Cart Mandate is signed when the agent presents a cart: an unchangeable record of the exact items and price, so what you see is what you pay for. Together they create a non-repudiable audit trail from instruction to payment.

AP2 is payment-agnostic by design: cards, stablecoins and real-time bank transfers all fit, and it works as an extension of the A2A protocol and MCP. Google announced it with more than 60 organizations (Adyen, American Express, Coinbase, Mastercard, PayPal and others named), launched an A2A x402 extension with Coinbase and partners for crypto payments, and in April 2026 donated AP2 to the FIDO Alliance, releasing v0.2 with Human Not Present payments as a headline feature.

Pick AP2 when the problem is proof and liability rather than settlement: marketplaces, platforms and regulated institutions that need to demonstrate exactly what a user authorized.

ACP: the checkout protocol

The Agentic Commerce Protocol, from OpenAI and Stripe, exists so an agent can buy from a normal store without the store rebuilding its stack. The merchant exposes checkout session endpoints; ChatGPT (or another agent surface) creates a session with the cart and buyer context, updates it, and completes it, with order webhooks keeping both sides in sync.

The payment design is the point: the merchant processes payment with its existing PSP and settlement, keeping orders, payments and compliance on its own stack. Where Delegated Payments applies, the agent pays with a Shared Payment Token (SPT). From Stripe's docs, an SPT is created from the customer's payment method against the seller's profile, with usage limits set at creation: currency, maximum amount and an expiration window. Risk signals travel with the token, so the AI platform can complete the transaction without sitting in the flow of funds or handling card data.

Access is split: building with ACP is open to all, while Instant Checkout in ChatGPT is limited to approved partners. Pick ACP when you sell physical or mainstream digital goods and want agent-driven checkout on your existing processor. It complements rather than competes with x402: ACP is for stores, x402 is for endpoints.

MPP: Stripe and Tempo's machine payments

The Machine Payments Protocol launched on 18 March 2026, co-authored by Stripe and Tempo, and covers similar ground to x402 with a different settlement philosophy. The flow will look familiar: an agent requests an API, service or MCP endpoint; the server returns HTTP 402 with payment details; the agent authorizes; the resource is delivered with a receipt.

Where MPP differs is what the agent can pay with and where the money lands. Through Stripe, businesses accept MPP payments in stablecoins and in fiat (cards and buy-now-pay-later) via Shared Payment Tokens, and MPP payments settle into the merchant's existing Stripe balance in its default currency on its standard payout schedule, with Stripe's tax, fraud, reporting and refund infrastructure attached. Published minimums on Stripe: $0.50 for card payments via SPTs and 0.01 USDC for stablecoin payments. Stablecoins sent to an onchain deposit address are automatically offramped into the Stripe balance. MPP also defines session-based payments for high-frequency use, where funds are set aside upfront and many small charges stream against them.

Pick MPP when you want machine payments but fiat settlement and Stripe's compliance stack, or when your buyers' agents carry both card tokens and stablecoins. Coinbase's and Stripe's protocols will coexist in most serious stacks; Crossmint already documents paying both x402 and MPP endpoints from the same wallet.

The identity and card layers underneath

Visa Trusted Agent Protocol is not a payment protocol. Built on HTTP Message Signatures and aligned with Web Bot Auth, developed with Cloudflare, it lets an agent attach cryptographic signatures to its traffic carrying three things: agent intent (retrieving details or buying a specific product), consumer recognition (whether the consumer already has a relationship with the merchant), and payment information for the merchant's preferred checkout. Its job is to let merchants recognize trusted agents with commerce intent and separate them from malicious bots, which matters because years of bot defenses otherwise block legitimate agent purchases.

Mastercard Agent Pay is a network program, not an open protocol. Its Agentic Tokens build on Mastercard's existing tokenization (the same base as contactless and card-on-file) to give agents dynamic credentials that are registered, verified and tied to a specific authorized interaction, with the permissions and limits the user defines. Mastercard is also incorporating Web Bot Auth so merchants can identify trusted agents. Agent Pay became usable through OpenAI's platform with Instant Checkout, which is the pattern to expect: card networks will mostly reach agents through ACP and their own token programs rather than through new merchant integrations.

So which protocol wins?

None, because they stack:

• Identity: Visa Trusted Agent Protocol, or KYA systems from Skyfire and Catena's ACK-ID.
• Authorization: AP2 mandates, or the mandate systems inside Nevermined and Skyfire.
• Checkout: ACP for stores; a platform's hosted checkout for everything else.
• Machine payment: x402 for crypto-native endpoints, MPP when fiat settlement matters.
• Settlement: stablecoins for machine speed, card rails (with Mastercard Agentic Tokens or Visa Intelligent Commerce credentials) for consumer reach.

The practical question for a builder is narrower: which combination do your counterparties already support? That is the matrix the agentic payments hub maintains, and how AI agents pay shows the same stack from the agent's side.

FAQ

Is x402 the same as MPP?

Both use HTTP 402 and a pay-then-retry flow. x402 is stablecoin-first, chain-agnostic and facilitator-based, with zero protocol fees. MPP adds card and BNPL payment via Shared Payment Tokens and, through Stripe, fiat settlement into a normal merchant balance.

Does AP2 move money?

No. AP2 proves authorization with signed mandates and works across payment types. The actual settlement happens on whatever rail the parties choose, including x402 for crypto payments via the A2A x402 extension.

Do merchants need a new processor for ACP?

No. ACP is designed so the merchant keeps its existing PSP, settlement and compliance. Only the checkout interface and, optionally, Delegated Payments with Shared Payment Tokens are new.

Which protocol should an API seller implement first?

x402 if your buyers are crypto-funded agents and you want the simplest live option; MPP if you want those same buyers to be able to pay by card and you want fiat in your Stripe balance. Several platforms (Nevermined, Crossmint) can put both in front of your API so you do not have to choose on day one.

Sources and method

Protocol facts were checked against primary sources on 25 October 2026: x402.org and Coinbase Developer Platform docs (x402 flow, facilitator pricing), Google Cloud's AP2 announcement and Google's April 2026 FIDO Alliance post (mandates, donation, v0.2), OpenAI's commerce spec and Stripe's Shared Payment Token docs (ACP), Stripe's MPP launch post and docs (dated 18 March 2026; minimums and settlement), Visa's Trusted Agent Protocol release and Cloudflare's Web Bot Auth release, and Mastercard's Agent Pay press release and Agentic Tokens story. Claims that rest only on secondary coverage were left out.

Compare the platforms that implement these protocols in the best agentic payment platforms guide, or browse the full matrix in the agentic payments hub.