Part 3 of the series "Humans, Agents, Mandates: The Web Learns Identity". Part 1 asked who owns identity; part 2 separated personhood credentials from agent mandates. Part 4 (When Your Agent Represents You) follows on September 12.
My agent finds a cheaper mobile plan and signs up. It books the hotel, renews the domain, orders the spare part. Every one of these sentences rightly triggers a reflex: wait - with whose money, with whose permission, and who is liable when it goes wrong? Precisely because money forces these questions, payments are the first field where the identity and mandate concepts of this series become production reality. And they do so on two separate rails that could hardly be more different: the card networks and the crypto world.
Rail 1: the card networks retool
Visa, Mastercard and Stripe have been racing through 2025 and 2026 to build their own agent infrastructure. The building blocks look similar:
- Mastercard Agent Pay, announced in April 2025, lets verified agents pay with "Agentic Tokens" - single-purpose stand-ins for the real card, technically an extension of proven tokenization. June 2026 brought the follow-up "Agent Pay for Machines" for continuously running autonomous systems.
- Visa Intelligent Commerce pursues the same goal and adds the Trusted Agent Protocol: cryptographically verify good agents, block malicious bots. The first secured agent transactions with partners are complete, with mainstream rollout targeted for 2026.
- Stripe delivers the developer side: Shared Payment Tokens let an agent pay with the customer's permission without ever seeing the card details - now connectable to Agent Pay, Intelligent Commerce and even buy-now-pay-later providers.
The most interesting piece sits beneath the brand names, though: the Agent Payments Protocol (AP2), originally proposed by Google and since handed over to the FIDO Alliance. AP2 defines vendor-neutral "mandates": cryptographically signed artifacts proving that a user authorized their agent to spend within specific limits. Anyone who read part 2 of this series will recognize it immediately - this is exactly the digital mandate, only in production rather than in a concept paper. With more than 60 partners from Mastercard, Visa and Stripe to PayPal, Adyen and Coinbase, the industry aligned on this format remarkably fast.
Rail 2: crypto finds its use case
In parallel, something happened that feels almost ironic after years of crypto searching for its purpose: the technology has found its tangible use case - as a payment rail for machines. The flagship is x402 by Coinbase, an open standard that finally breathes life into HTTP status code 402 "Payment Required", reserved in the web standard since 1997 but never used. The flow: an agent calls a paid API, receives a 402 response with payment instructions, signs a stablecoin payment (usually USDC) and gets the data - within seconds, no account, no credit card, no login.
The numbers are no longer rounding errors: by spring 2026, roughly 69,000 active agents had processed more than 165 million x402 transactions. Cloudflare co-founded the x402 Foundation and built the protocol into its Workers platform, and of all companies Stripe - the card rail - has been settling USDC payments through it since February 2026. The reason nobody uses cards here: this is about micropayments, often fractions of a cent per API call. For card networks with their fixed fees that is structurally uneconomical; for a signed on-chain payment it is the normal case. Honesty demands the counterpoint: CoinDesk notes that organic demand from the agent economy still lags the infrastructure build-out. The rails are laid; how many trains will run remains open.
Not either-or: the split stack
You might expect a holy war - cards versus crypto. In reality the market is sorting itself along a much more sober line: card rails for consumer shopping (buyer protection, chargebacks, familiar liability rules), stablecoins for machine-to-machine (speed, micro amounts, no account opening required). And the camps are already interleaving: Mastercard Agent Pay's partner list features Coinbase, the Solana Foundation, Polygon and Ripple alongside classic payment providers.
Behind this sits a simple insight: an agent cannot open a bank account and cannot receive a one-time SMS code. A wallet with signable keys is the natural form of identity and money for software. Crypto is not winning here as an ideology but as a toolbox - key pairs, signatures and stablecoins simply are the primitives a world of autonomous agents needs.
Interim conclusion: three layers in place
That puts three layers in place. Part 1: identity must belong to the person, not the platform - the Fediverse, Berners-Lee's Solid and the EUDI wallet are building that foundation out of key pairs and wallets. Part 2: on this foundation, two kinds of credentials emerge - personhood proofs for humans, signed mandates for their agents. Part 3: payments are the first industry to implement exactly this model, with card tokens for shopping and stablecoin payments for the machine world.
The most exciting open question is how the strands connect: once the state-issued EUDI wallet sits on phones from 2027 and AP2 mandates become the industry standard, the step toward an officially anchored agent mandate - "this agent provably acts for this person, within these limits" - is no longer science fiction but a matter of regulatory drafting. One layer is still missing, though, and it is the most personal one: the agent that does not just pay but represents you online - writing emails, negotiating, appearing in your name. Why today's browser agents are the wrong path for that, and what real representation requires, is the subject of part 4 on September 12.
Sources
- Forbes: Stripe, Visa And Mastercard Race To Build AI Agent Payment Rails - market overview of the card rail
- Mastercard: Mastercard launches Agent Pay for Machines - Agentic Tokens, extension for autonomous systems, partner list
- Visa: Intelligent Commerce and Visa and Partners Complete Secure AI Transactions - Trusted Agent Protocol, pilot transactions
- Stripe: Supporting additional payment methods for agentic commerce - Shared Payment Tokens, connections to Agent Pay and Intelligent Commerce
- RisingWave: Mastercard Agent Pay vs Visa Intelligent Commerce vs Stripe Agentic Commerce - comparison of the approaches, AP2/FIDO mandates, split stack
- Coinbase: Introducing x402: a new standard for internet-native payments and x402 documentation - protocol, HTTP 402, USDC
- The Block: What is Coinbase's x402 protocol? - how it works
- CoinDesk: Coinbase-backed AI payments protocol wants to fix micropayments but demand is just not there yet - critical view of demand
- Forbes: Visa, Mastercard And Coinbase Are Fighting Over How AI Agents Pay - card rail versus stablecoin rail