--- title: "Hours of KYC, one HTTP 402: what we learned taking payments for agents" date: 2026-10-20 type: Blog outlet: klminnovation.com topics: ["AI & LLMs", "Strategy"] topic_ids: [0, 7] slug: 2026-10-agentic-payments-x402 summary: "Getting set up on traditional rails took hours of identity checks and paperwork. Getting paid by an agent over x402 takes one HTTP exchange. Here's what we built at KLM Innovation, why both worlds still matter, and what we'd tell other builders." published_path: /blogs/published/2026-10-agentic-payments-x402.html --- ![Paper KYC stack and clock on the left, a single HTTP 402 exchange on the right](2026-10-agentic-payments-x402/visuals/slot-a-hero.png) # Hours of KYC, one HTTP 402: what we learned taking payments for agents ## Executive Summary Before KLM Innovation could take its first payment, we put in many hours: forming the LLC, opening traditional business bank accounts, setting up DeFi and crypto accounts, and filling out all the paperwork each of those steps requires. Our paid endpoint was already built and waiting. Meanwhile, an AI agent can pay that same endpoint in one HTTP exchange, with no account, no form and no human in the loop. Traditional finance runs on knowing who you are before money moves. Agentic payments run on proving a payment is valid at the moment it's made. Both have a job to do, and builders will need both for a while. The agentic side just got a big vote of confidence. On October 20th, Mastercard showed Agent Pay for Machines at Cloudflare Connect, and it's built on the same x402 protocol we use. This post is a spotlight on the hurdles holding back agentic payments and an AI-fueled economy. It isn't about AI bubbles or datacenter spending. It's about something more basic: letting AI agents consume content and services online the same way humans do today. ## The paperwork side We chose JPMorgan Chase as our TradFi provider and Coinbase as our DeFi provider, and the two are intertwined. Coinbase CDP required a verified business bank account, which is what led us to Chase. None of this is a complaint about Chase or Coinbase. They did nothing wrong. They're following the letter of the law and doing what regulation requires to know their customers. Know-your-customer rules exist for good reasons, and banks and payment platforms don't get to skip them. Here's what it looks like in practice, though. Chase's own checklist for opening a business checking account asks for each 10%+ owner's legal name, address, date of birth, tax ID, citizenship and ownership share. It can also ask for a digital scan of a government ID, proof of business registration like Articles of Organization, and details on your locations, suppliers, annual sales and expected transaction volume. Online applications only work for certain business structures. Everyone else goes to a branch. Then the payment platform does its own round. In our case that meant personal and business documents for the Coinbase Developer Platform, and then a waiting period for review. Coinbase's help center says that once you've completed identity verification, you'll get a notification of the review status within 24 hours. Coinbase's CDP facilitator is a solid product. It does OFAC and know-your-transaction screening on payments, which is real value. It just isn't a same-day setup when you're starting from zero. We also pivoted to PayAI so we could support Solana, not just Base. For a human-run business opening one account, that's annoying but fine. For software that wants to buy one API call for a dollar, it doesn't work at all. ## The HTTP side x402 takes a status code that's been sitting mostly unused in the HTTP spec, 402 Payment Required, and puts it to work. The flow is short: 1. A client asks for a paid resource. 2. The server answers 402 with a `PAYMENT-REQUIRED` header listing the price, network, asset and where to pay. 3. The client signs a payment and retries the same request with a `PAYMENT-SIGNATURE` header. 4. The server has a facilitator verify and settle it, then returns the content with a `PAYMENT-RESPONSE` header. That's the whole loop. One request, one 402, one paid retry. The x402 docs note that with the common `exact` scheme, funds typically settle in that same round trip. No account on our side, no stored card, no API key for the buyer to manage. BlackRock's Digital Assets Research team made a similar point in a recent paper, *The Machine-Native Economy*. They argue agentic commerce needs machine-native payment rails. Existing rails like ACH and cards automate a lot, they write, but onboarding requirements and settlement economics make them a weaker fit for always-on, very low-value, programmable transactions. They name x402 as one emerging standard for that kind of traffic and see stablecoins like USDC as an early primary use case. That's their research view of the market, not an endorsement of us or any asset. They're also clear the space is still nascent. ## What we actually built KLM Innovation's paid Playbook Plus endpoint on klminnovation.com accepts $1 in USDC over x402. The 402 offers both Base and Solana mainnet. We've verified Base end to end with a real payment, and Solana browser checkout is coming soon. Payments go through the PayAI facilitator. This isn't a lab demo. We made a real $1 payment on Base ourselves, end to end, and the content came back with a settled payment on chain. There are two ways in: - **Agents** get a machine-readable 402. They read the price and payment terms straight from the response, sign and retry. No human has to click anything. - **Humans** get a browser wallet checkout on the same endpoint. Connect a wallet, approve $1, and the content loads. Agents also have to find you before they can pay you. So the endpoint publishes the usual machine-readable signposts: a /.well-known/x402 file with the price, networks and terms, an OpenAPI description, and an agents.json flow that walks an agent through checking the price and buying. The 402 itself carries input and output descriptions so x402 indexers can list it without a human filling out a form. The facilitator choice mattered more than we expected. Setting up PayAI was easier than the Coinbase path. PayAI's docs say you can start taking ordinary payments on mainnet without a portal account or API key, just a receiving wallet and the route you want to charge for. We went a step further and set up our own merchant key, and it was still noticeably easier. One gotcha we hit while preparing Solana: the receiving wallet needs a USDC token account to exist before it can get paid, and nothing creates it for you. We plan to add Coinbase CDP later. ## What the dollar actually buys Making payment easy for agents raises a fair question: what are they paying for? It isn't just the output of a frontier model. Models hallucinate, even the latest ones. Playbook Plus is guidance we build and steer, drawing on our founder's nearly 30 years in this industry. That experience goes in as paved roads, guardrails and subject-matter expertise our agents work from, and each pack ships dated and pinned so your agents can fetch it, verify it against a published hash and reuse it. The protocol moves the dollar. The expertise behind it is what makes it worth spending. ## A card network bets on x402 On October 20th, at Cloudflare Connect, Mastercard showed Agent Pay for Machines. Mastercard says it builds on x402 and connects it with the trust, security and reach of its card network. A business gives an agent a task and a spending limit. When a paid service answers 402 Payment Required, the agent signs a payment voucher within that limit, the provider verifies it and the work continues. Providers can combine vouchers and redeem them later. In Mastercard's pilot demo with the marketing agency Hype, one agent made nine payments to two independent merchants under one approved budget, with no separate accounts, API keys or invoices. Those 402 responses came through Cloudflare's Monetization Gateway, which applies x402 payment requirements to APIs, MCP tools, sites and datasets. The gateway is in closed beta, and Cloudflare says buyers and sellers must be based in the United States. After its pilots, Mastercard is opening Early Access to its buyer and seller APIs, toolkit and sandbox. That's more validation of the agentic economy. x402 now has a global card network and one of the biggest edge networks building on it, alongside the crypto-native teams that got it started. Mastercard also put the hard part plainly: "Payments aren't the hard part. Authority is." We agree, and that's where the next section starts. ## What this doesn't solve Payment isn't permission. PayAI's own guide says it plainly: paying for a resource doesn't prove you're allowed to see someone else's data. If your paid route touches anything user-specific, keep your normal auth in front of it. A few other things we'd flag for builders: - **Prove the paid path, not just the 402.** A 402 response only shows you asked for money. Test a real, finalized settlement with the exact amount, payer and recipient. - **Plan for lost responses.** If an HTTP response drops mid-payment, reconcile the original authorization before charging again. Don't let a client blindly pay twice. - **Keep payment inputs server-fixed.** Price, network and payout address should come from your config, never from the request. - **Decide your refund story up front.** On-chain payments don't reverse themselves. Ours is spelled out in [our terms](/legal/machine-tos.md). ## Where this leaves us TradFi checks who you are before money moves. x402 checks that the payment is valid when it moves. We think both stay. Banks and processors will keep running human commerce, subscriptions and anything that needs a chargeback. Agentic rails will pick up the small, fast, machine-to-machine buys that never made sense on cards. For us, that meant many hours of setup and paperwork on one side and a much shorter integration on the other. If you're building APIs that agents will call, it's worth trying the second path now, while it's still early. With Mastercard and Cloudflare in the mix, it won't stay early for long. ## Sources - [Mastercard: What happens when AI agents start paying each other? Watch Mastercard Agent Pay for Machines in action](https://www.mastercard.com/global/en/news-and-trends/press/2026/october/Mastercard-Agent-Pay-for-Machines-in-action.html) - [Cloudflare Docs: Monetization Gateway](https://developers.cloudflare.com/monetization-gateway/) - [BlackRock Digital Assets Research, *The Machine-Native Economy* (PDF)](https://www.blackrock.com/us/individual/literature/whitepaper/the-machine-native-economy.pdf) - [x402 docs: HTTP 402](https://docs.x402.org/core-concepts/http-402) - [x402.org](https://www.x402.org/) - [PayAI: Accept payments from AI agents in your API or SaaS](https://docs.payai.network/guides/accept-payments-from-ai-agents.md) - [PayAI: x402 Introduction](https://docs.payai.network/x402/introduction) - [Coinbase Help: Verify your identity on Coinbase](https://help.coinbase.com/en/coinbase/getting-started/getting-started-with-coinbase/id-doc-verification) - [Coinbase Developer Platform: CDP Facilitator](https://docs.cdp.coinbase.com/x402/core-concepts/facilitator) - [Chase for Business: Get ready to open your business checking account](https://www.chase.com/business/resources/business-bank-account-information)