Mastercard opened early developer access to Agent Pay for Machines (AP4M) on October 20 at the Cloudflare Connect conference, making buyer- and seller-side APIs, SDKs, and a sandbox environment available to third parties for the first time. The system lets AI software agents execute payments auto...
Mastercard opened early developer access to Agent Pay for Machines (AP4M) on October 20 at the Cloudflare Connect conference, making buyer- and seller-side APIs, SDKs, and a sandbox environment available to third parties for the first time. The system lets AI software agents execute payments autonomously — across cards, bank accounts, and stablecoins — within budgets and permissions set by a human principal. Settlement runs on Base, Coinbase's Ethereum L2, using USDC via the open x402 protocol.
The move places Mastercard inside a multi-front race among Visa, Stripe, PayPal, American Express, and Google to define the trust and settlement layer for agentic commerce — a market that analyst firms size at $8 billion in 2026 transaction value (Juniper Research), scaling to projections ranging from $187 billion (IDC) to $3.5 trillion (Juniper) by 2030-2031. Mastercard's bet is that the payment network that can verify agent identity, enforce spending controls, and guarantee settlement at machine speed will capture the plumbing layer of this market.
Agent Pay for Machines is built on x402, an open HTTP payment protocol that repurposes the long-dormant HTTP 402 ("Payment Required") status code. Coinbase released the initial x402 specification in May 2025. The protocol works as follows:
The protocol uses EIP-3009 (transferWithAuthorization) for gasless USDC transfers and Permit2 for other ERC-20 tokens. Off-chain voucher signing lets agents transact at machine speed without incurring per-call blockchain settlement costs. On-chain settlement occurs on Base.
Mastercard layers its own network controls on top of x402: agent credentialing, per-agent spending caps, transaction-level fraud scoring, and guaranteed settlement through the Mastercard network. The result is a two-tier system — open protocol at the transport layer, proprietary trust infrastructure at the authorization layer.
At Cloudflare Connect, Mastercard demonstrated AP4M with a live scenario. Marketing agency Hype assigned an AI agent the task of preparing a campaign for a protein bar launch. The agent was given a pre-approved budget and told to purchase social media research from AIsa and generate eight campaign images via Cloudflare AI Gateway.
The agent executed nine separate payments across the two merchants. Payment requests arrived through Cloudflare Monetization Gateway. The agent signed vouchers; sellers verified them before delivering work. Coinbase Developer Platform supplied the wallet infrastructure for funding the agent. Base provided on-chain settlement.
End-to-end pilot partners include Cloudflare, Ant International, BVNK, AIsa, Base, and Coinbase. Mastercard stated it has over 30 initial partners collaborating to scale the ecosystem.
The demonstration is narrow in scope — nine payments in a controlled environment. Production-scale performance data (throughput, latency under load, failure rates) has not been published.
The Linux Foundation operationally launched the x402 Foundation on July 14, 2026, with 40 founding members organized in three tiers:
Premier Members (17): Adyen, Amazon Web Services, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Monad Foundation, MoonPay, Ripple, Shopify, Solana Foundation, Stellar Development Foundation, Stripe, and Visa.
General Members (18): Aleo, Fireblocks, Galaxia Moneytree, Hecto Financial, Injective, KakaoPay, Kite AI, LayerZero Labs, Merit Systems, NEAR Foundation, Orthogonal, Polygon Labs, Quant Network, SKALE, t54 labs, utexo, World Liberty Financial, and zerohash.
Associate Members (4): BSV Association, Cardano Foundation, Casper, and OMA3.
The membership list is notable for what it represents: every major card network (Visa, Mastercard, Amex), the two dominant stablecoin infrastructure providers (Circle, Coinbase), multiple L1 foundations (Solana, Stellar, Ripple, NEAR, Polygon), and major cloud and commerce platforms (AWS, Google, Shopify, Cloudflare). This is the broadest cross-industry coalition yet assembled around a single payment protocol specification.
The Foundation's mandate is to govern the x402 specification and ensure interoperability across payment methods and blockchain networks. Coinbase contributed the original protocol code.
Mastercard is not operating in a vacuum. According to Forbes (October 23), at least five major payment networks are building agentic commerce trust layers simultaneously:
| Player | Protocol/Product | Approach | |--------|-----------------|----------| | Mastercard | Agent Pay + AP4M | Agentic tokens, spending rules, Verifiable Intent (March 2026), x402 settlement | | Visa | Intelligent Commerce Connect | Network-agnostic connection layer, tokenization, authentication signals (April 2026) | | Stripe | Agentic Commerce / Agent Toolkit | Wraps existing Stripe APIs for LLM use, Issuing virtual cards with per-agent spend limits, OpenAI Agents SDK integration | | Google | Agent Payments Protocol (AP2) | 60+ partners aligned including Mastercard, Visa, Stripe, Adyen, PayPal, Coinbase | | PayPal | Agent Commerce Tools | Payment acceptance on AI platforms, merchant catalog discovery for agents |
The key competitive question, according to industry observers, is not which protocol "wins" but which entity becomes the trust anchor — the layer that verifies an AI agent acted within its buyer's intent, and assigns liability when it does not. Mastercard's Verifiable Intent framework, introduced in March 2026, attempts to address this by producing a cryptographic attestation that an agent's transaction matches the intent specified by its human principal.
One week before the AP4M early access announcement, Mastercard unveiled Stablecoin Security at Money20/20 USA on October 19. The product is a risk intelligence API that screens stablecoin transactions for fraud, sanctions violations, and financial crime indicators before funds move on-chain.
Borderless.xyz and Keyrails are the first integration partners. Both participated in Mastercard's Start Path Blockchain and Digital Assets accelerator program.
The service works across multiple blockchain platforms. It assigns a risk score based on transaction context, source-of-funds analysis, and blockchain analytics. Banks integrate via API alongside their existing compliance infrastructure.
Initial availability is North America, with worldwide rollout expected in 2027.
The timing is deliberate. AP4M enables autonomous agent payments; Stablecoin Security provides the compliance screening layer that regulated financial institutions require before they will route value through those rails. The two products are designed to operate as a stack.
Analyst estimates for agentic commerce vary by an order of magnitude depending on definition and scope:
| Source | 2026 Estimate | 2030-2031 Estimate | CAGR | |--------|--------------|-------------------|------| | IDC | $38.2B | $187B (2030) | 59.3% | | Juniper Research | $8B (transaction value) | $3.5T (2031) | — | | Grand View Research | $7.7B | — | — | | NextMSC | $17.66B | — | — | | McKinsey | — | $3-5T (end of decade) | — |
The wide variance reflects fundamental disagreement about what counts as "agentic commerce." Juniper's $8 billion captures transaction value flowing through agent-initiated payments. IDC's $38.2 billion includes software, services, and infrastructure spending. McKinsey's $3-5 trillion figure encompasses all commerce that AI agents will "orchestrate" by decade-end — a much broader definition.
What the estimates agree on directionally: the market is growing at triple-digit annual rates from a small base, and the infrastructure layer (protocols, settlement, trust) is being built now.
The economic value distribution question for agentic commerce payments is unresolved. Multiple parties will extract fees from every agent-initiated transaction:
The critical question is where the margin concentrates. If x402 becomes the dominant open standard — which the 40-member Linux Foundation coalition suggests is the intent — then the value capture shifts to the layers above: trust/identity (Mastercard, Visa), compliance (Stablecoin Security), and distribution (Coinbase, Cloudflare).
This mirrors the pattern observed in internet protocols: HTTP itself is free; the value accrues to the services built on top. Mastercard appears to be positioning itself as the "trust layer" atop an open payment transport, the same structural position it occupies in card-based commerce.
Mastercard's $80 trillion addressable B2B payments market (cited by Forbes, October 23) provides the upper-bound context. Even fractional penetration by autonomous agents would represent meaningful volume for infrastructure providers.
Mastercard's AP4M launch marks the first time a major payment network has opened production developer tools for AI-agent-initiated stablecoin payments settled on a public blockchain. The technical stack — x402 for transport, USDC for settlement, Base for finality, Mastercard for trust — is functional but unproven at scale.
The more significant development may be the x402 Foundation itself. Seventeen premier members spanning card networks, stablecoin issuers, cloud providers, and blockchain foundations have agreed to govern a single open payment standard. Whether this coalition holds as commercial interests diverge remains to be seen.
The agentic commerce market is real but early. Mastercard is not the only entrant, and no protocol has achieved meaningful transaction volume. What Mastercard does have is an existing trust relationship with millions of merchants, a compliance infrastructure that regulators recognize, and a 60-year track record of inserting itself as the intermediary layer in new payment modalities. Whether that advantage translates to agent-to-agent commerce — where transactions are measured in fractions of cents at thousands per second — is the open question.