Specoria
Menu
TR Free test

InsightsAgentic commerce

AP2 moved to the FIDO Alliance and x402 to the Linux Foundation: what the payment protocol handovers mean for stores

Google gave AP2 to the FIDO Alliance and x402 moved to the Linux Foundation. What mandates and HTTP 402 payments are, and what stores should watch for now.

By 8 min read
A cut-paper collage showing a plaster hand holding a sealed envelope, with a blank receipt and a paper shopping bag beside it and one violet paper strip across the table.
A shopper's yes, sealed on paper before the agent walks to the till. Illustration: Specoria · generated with AI

Two of the payment protocols built for AI agents changed owners this spring. In April, Coinbase's x402 moved to a new foundation at the Linux Foundation, and Google handed its Agent Payments Protocol (AP2) to the FIDO Alliance, the industry group behind passkeys. Neither change put a new button on anyone's checkout. What changed is who writes the rules.

For a store owner, the useful questions are plainer than the announcements: what do these two protocols actually do, does either one need anything from you today, and what should you ask your payment provider? In this article, we answer those questions and keep to what the primary sources say. The short version: this is early, and for most stores the right move now is to watch and ask, not to integrate.

What happened

  • April 2, 2026: x402 moves to the Linux Foundation. The Linux Foundation announced it was launching the x402 Foundation with the contribution of the x402 protocol from Coinbase, which created it. The Linux Foundation calls the new foundation a neutral home for the standard. The companies that expressed initial support include Adyen, Amazon Web Services, American Express, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Microsoft, Shopify, Stripe and Visa.
  • April 28, 2026: AP2 moves to the FIDO Alliance. Google announced it was donating AP2, first introduced in September 2025, to the FIDO Alliance, so that the protocol stays platform-agnostic and community-led. On the same day, Google released AP2 version 0.2, which adds "Human Not Present" payments: an agent can complete a purchase on its own, based on instructions the person approved in advance. Google's example is buying limited-run tickets the moment they go on sale.

The FIDO Alliance announced the related work the same day. It formed an Agentic Authentication Technical Working Group, chaired at launch by members from CVS Health, Google and OpenAI, and is developing specifications for agent-initiated commerce in its Payments Technical Working Group, chaired by members from Mastercard and Visa. Alongside AP2, Mastercard contributed Verifiable Intent, a framework co-developed with Google and designed to work with AP2.

AP2 in plain words: a signed record of what the person allowed

A cut-paper collage with a paper browser window beside a stone arch, a small violet paper coin in the arch opening and a plain parcel on the table.
Payment slips into the ordinary web request, like a coin passed through an old stone gate. Illustration: Specoria · generated with AI

Card payments were designed around a simple assumption: a person is on a trusted website, clicking "buy". When an agent pays, that assumption breaks. The AP2 documentation names the three questions that follow: did the person really give the agent authority for this purchase, does the request reflect what they wanted, and who is accountable if it goes wrong?

AP2's answer is the mandate: a digitally signed record that can't be changed without detection. There are two kinds:

  • Checkout mandate. It records the specific items and purchase details agreed between the agent and the merchant, and it is shared with the merchant. Inside it sits a checkout record signed by the merchant.
  • Payment mandate. It authorizes a payment with a specific card or other payment method, and it is shared with the payment side: the credential provider, the card networks and the merchant's payment processor.

Each mandate can be open or closed. An open mandate holds the person's limits before a cart exists: which merchants are allowed, which items, what budget. A closed mandate approves one finalized checkout and one amount. Open mandates are what make "Human Not Present" purchases possible; closed mandates cover the familiar case where the person confirms the final basket.

Why should a merchant care? The AP2 FAQ says that in a dispute, the card network can compare the user-signed checkout mandate with the details of the dispute to help decide who is accountable. That is the part with direct value for a store: evidence of what the shopper approved, attached to the order. We looked at a live demonstration of signed mandates in When the agent checks the store.

x402 in plain words: payment inside the web request

When the web's status codes were defined, one number was set aside for payments. MDN describes HTTP 402 "Payment Required" as a nonstandard code reserved for future use, with no standard convention for how to use it.

x402 gives that code a job. A client asks a server for something. If the request arrives without payment, the server answers with 402. The client pays and sends the request again, and the server returns the resource. No account, no form and no API key are needed along the way.

The x402 site says stablecoin payments are the primary use case and names API access, paywalled content and agentic commerce among its uses. The project says it aims to support all networks, both crypto and traditional, and the site says it is extensible to traditional payment methods. x402 also says it charges no protocol fees, only the fees of the payment network used.

Our reading: x402 fits paying per request for something digital, such as a data call or an article, better than it fits a basket of physical goods with shipping, returns and a card on file. That may change as the work continues, but it is where the protocol stands today.

AP2 and x402 solve different problems

The two are easy to confuse because they arrived in the same news cycle. They sit at different layers.

  • AP2 is about authority and evidence. It describes who allowed what, and it is designed to work with any payment method. Its documentation includes samples for both cards and x402.
  • x402 is about moving the money inside an ordinary web request.
  • UCP sits above both. The AP2 FAQ describes the Universal Commerce Protocol as orchestrating the wider purchase, with AP2 as the payment layer that authorizes and signs. For Google's AI Mode and Gemini, the FAQ tells merchants to use UCP and add the AP2 extension if they plan to support autonomous purchases.

What it means for most stores right now

There is probably nothing to integrate yet. The AP2 FAQ says an SDK and an MCP server are being built together with payment service providers, and the project's GitHub page says a package will be published at a later time. The specification work itself now continues inside FIDO's working groups, which means further changes will come through a standards process. Our expectation is that most stores will meet AP2 through their checkout platform or payment provider, not by building it themselves.

Expect orders with no person present. "Human Not Present" means an order can be placed while nobody is watching the session. If your fraud rules lean on signs of a person, such as typing speed or a recent login, they may treat these orders differently. We covered that side in Agent orders are reaching your fraud filter.

Turkey is not on the map yet. The AP2 site names no Turkey-specific program or partner. For stores selling mainly in Turkey, this is a topic to follow, not a project.

The neutral home is good news, slowly. A protocol owned by a standards body is less likely to change because one company changed strategy, and the working groups include card networks, platforms and AI companies. The trade-off is pace: standards processes take time.

Questions to ask your payment provider

  1. Do you plan to accept AP2 mandates or Verifiable Intent, and will the mandate be stored with the transaction?
  2. If an agent order is disputed, can that record be used as evidence, and who keeps it?
  3. Will agent-initiated payments be marked in our reports, so we can see them separately?
  4. Do you support x402 or stablecoin settlement, and in which countries and currencies?
  5. How will a payment with no person present work alongside 3-D Secure and strong customer authentication in our markets?

The bottom line

The April handovers moved AP2 and x402 from single companies to neutral standards bodies. AP2 brings signed mandates that record what a shopper allowed, which could become useful evidence for merchants. x402 turns an old, unused HTTP status code into a way to pay inside a web request, today mostly with stablecoins. Both are early. For most stores, the work for now is to ask good questions and keep the basics right: an agent can only act on a mandate for a product whose price, stock and checkout it can read.

Specoria measures those basics, from product data an agent can verify to whether a real browser agent can reach your checkout. Start with a free readiness test.

Sources