2026 agent-payment projects survey · 09_identity_ai/AI_PAYMENTS_LANDSCAPE.md

AI Agent Payments Landscape — 2025–2026 Survey (for Qals)

Compiled: 2026-09-06 (superlocal research agent) Method: Primary sources fetched live (x402.org, skyfire.xyz, nevermined.io, tempo.xyz, agenticcommerce.dev, github.com/coinbase/agentkit, modelcontextprotocol.io, github.com/lightninglabs/L402, near.org, webbotauth.org). DuckDuckGo/Bing were bot-blocked; items marked [UNVERIFIED] rely on pre-2026 knowledge or secondary confirmation and should be re-checked before citing.

1. x402 (x402 Foundation / Linux Foundation)

What: Open standard for internet-native payments using HTTP 402 Payment Required. Server adds one line of middleware; client (agent) pays on retry with a signed payment payload (X-PAYMENT header), a "facilitator" verifies/settles, server returns X-PAYMENT-RESPONSE.

2026 status (verified x402.org, fetched 2026-09-06): Now governed by the x402 Foundation under the Linux Foundation (operational-launch announcement linked on site). Site displays trailing-30-day network stats: 75.41M transactions, $24.24M volume, 94.06K buyers, 22K sellers — i.e. real, at-scale usage, but average ticket ≈ US$0.32, confirming it is a microtransaction protocol. Members/trusted-by logos: Stripe, Cloudflare, AWS, Alchemy, QuickNode, Vercel, Messari, Nansen, World. FAQ states production-ready, audited, blockchain-agnostic: all EVM chains, Solana, "and more"; stablecoins primary; extensible to non-crypto rails.

Qals action — ADOPT (this is the single highest-value integration). The accepts array in a 402 response is explicitly multi-network/multi-scheme, so a private chain can expose an x402-compatible endpoint: register a qals payment scheme where the credential is a chain-verifiable B-QALS transfer (escrow/release or burn-on-use) against the GPU-agent's DID, and run the Qals facilitator that verifies settlement on our chain and emits the standard response header. Caveats: (1) inbound traffic from public x402 agents will arrive wanting USDC on Base/Tempo/Solana — we need a USDC⇄B-QALS exchange leg at the perimeter; (2) keep our scheme field-compatible with the v2 spec (Solana-era, multi-scheme) so stock x402 clients can negotiate it.

2. Coinbase AgentKit + CDP wallets

What: Open-source toolkit giving LLM agents a wallet + onchain actions (TS/Python; framework extensions for LangChain, OpenAI Agents SDK, Vercel AI SDK, MCP, ElizaOS). Wallet providers: Coinbase CDP, Privy, viem. Networks: Base/Ethereum/Solana + any EVM/SVM; smart-wallet examples (ERC-4337/7702-style). 2026 status (verified, github.com/coinbase/agentkit): Active repo (521 commits, 1.3k stars, 807 forks; npm/pypi download badges live). Notably, the README carries an unusually blunt risk disclosure: AgentKit does not gate transfers behind human approval, enforce spend caps, or allowlist destinations — prompt injection + funded wallet = arbitrary transfer. Qals: BORROW the SDK shape (action providers, MCP extension, wallet-per-agent provisioning) for our agent SDK; differentiate on the thing Coinbase admits they can't do: chain-enforced spend caps. B-QALS mint-on-deposit plus Move-native mandate objects give us protocol-level limits AgentKit only approximates with middleware.

3. Stripe — Tempo L1, MPP, ACP, Shared Payment Token

Tempo (verified tempo.xyz, fetched 2026-09-06): Payments-first L1 incubated by Stripe and Paradigm, mainnet-live with explorer/wallet/status pages. Stablecoin-native gas (fees in USD stablecoins), dedicated payment lanes, built-in stablecoin DEX, ~0.6s deterministic finality, opt-in privacy with compliance audit hooks. Ecosystem partners include Anthropic, OpenAI, Visa, Mastercard, Deutsche Bank, Standard Chartered, UBS, Shopify, Klarna, Revolut, Nubank, DoorDash — and it markets "Agentic Payments" as a first-class use case. MPP — Machine Payments Protocol (verified nevermined.io/mpp, fetched 2026-09-06): challenge/credential protocol over RFC 7235: server answers 402 with WWW-Authenticate: Payment, agent retries with Authorization: Payment <cred>; settles card or Tempo-chain (USDC.e / EURC.e); "aligned with the emerging AP2 / agentic-commerce standards." ACP — Agentic Commerce Protocol (verified agenticcommerce.dev): Stripe+OpenAI open standard (Apache-2.0) behind ChatGPT Instant Checkout; REST and MCP-compatible; merchants stay merchant-of-record; Stripe Shared Payment Token is the first PSP integration; businesses apply to be listed in ChatGPT.

Qals: Tempo's design (stablecoin gas, payment lanes, privacy-with-auditability, payments metadata memos) is a menu of design validation for a private settlement chain. INTEROP target: speak MPP's WWW-Authenticate: Payment scheme as a second inbound path (it is trivially close to our x402 work), and study ACP if we ever let external agents buy inside a Qals "storefront."

4. Card networks: Visa, Mastercard, PayPal

• Visa Intelligent Commerce (launched May 2025): agent-ready "Trusted Agent" programme with Cloudflare, payment credentials provisioned per-agent (tokens replacing PANs), merchant/issuer risk controls. 2026 detail pages unreachable today (404) — [UNVERIFIED current status] — but Visa's participation is independently confirmed today via Tempo's partner list, Nevermined's design partners, and Skyfire.
• Mastercard: "Agent Pay" + Agentic Tokens (announced mid-2025, rollout from 2026) — tokenised credentials scoped to specific agents/merchants. Same today-confirmations apply; direct pages unreachable [UNVERIFIED details].
• PayPal: agentic commerce push (Microsoft + Perplexity partnerships 2025, PYUSD stablecoin, "Agent Ready" merchant toolkit) — [UNVERIFIED 2026 status]; PayPal/Braintree confirmed today as Nevermined design partners.

Qals: AVOID building on card rails for agent-loop settlement (fees, chargebacks, KYC drag); BORROW their mandate/tokenisation model — "agent-bound, merchant-scoped, revocable token" is exactly a B-QALS mandate object, and regulators already understand the vocabulary.

5. Google AP2 (Agent Payments Protocol) + Web Bot Auth

• AP2 (announced Sept 2025, 60+ partners incl. Mastercard, PayPal, Adyen, Coinbase): mandate-based model — Intent Mandate (what the user authorised the agent to want), Cart Mandate (signed cart), Payment Mandate (signed proof of user approval for a payment), presented to PSPs/issuers. Native site and GitHub were unreachable today (DNS/404) — 2026 governance status [UNVERIFIED] — but AP2 remains the reference mandate vocabulary (Nevermined's live MPP explicitly aligns to it).
• Web Bot Auth (verified webbotauth.org, fetched 2026-09-06): now an IETF Working Group (datatracker wg/webbotauth) building on RFC 9421 HTTP Message Signatures; a live independent directory tracks OpenAI, Anthropic, Google, You.com publishing public key directories for their crawler/agent signatures.

Qals: AP2's three-mandate ontology is the best-practice mental model — map it onto Move objects (escrowed GPU job = cart mandate; per-agent B-QALS cap = intent/payment mandate). Our existing W3C VC + RFC 9421 plan is validated and should be expressed as Web Bot Auth-compatible signing so Qals agents present standard headers on the open web.

6. Skyfire (agent trust + payments network)

What/2026 (verified skyfire.xyz): Alive and repositioned as the "Agent Trust Stack": KYA (Know Your Agent) identity tokens, agentic wallet, and "Buy for Me" checkout using tokenised cards (Visa/Mastercard/Discover) plus USDC, with user mandates. Partner logos: Mastercard, Experian, Akamai, DataDome, Okta, Auth0, Fastly, Reuters, Consumer Reports, f5, HUMAN Security (KYAPay.org for merchant acceptance). Claims its KYA token is accepted across "60%+ of the commercial internet" [vendor claim]. Qals: BORROW the KYA framing — "Know Your Agent" is the exact narrative bridge between our DID layer and payments (agent KYA + human principal + mandate bound in one token). Avoid coupling our settlement to their network.

7. Nevermined

What/2026 (verified nevermined.io): Pivot complete: from web3 "AI-to-AI payment registers" to an agentic payments platform on card rails + Tempo. Products: delegated Visa virtual cards per agent with mandates (budget, per-call caps, one-click revoke), pay widgets, merchant metering/acceptance keeping the merchant's PSP (Stripe/Braintree), a Router that detects and pays x402 or MPP endpoints, Commerce MCP, Agent Catalog. Design partners: Visa, Mastercard, PayPal, Braintree, Exa, You.com, AWS, VGS. Live case: Exa sells API keys to agents for $7 paid autonomously on a delegated card. Gartner "Cool Vendor 2026" (Agentic AI in Banking). Qals: Nevermined is the closest competitor to the Qals payment loop — their mandate model (budget + per-call cap + revoke, all observable) is precisely what we enforce on-chain. BORROW their merchant-side metering UX and the Router idea (one endpoint, many payment protocols); note their caps are policy-layer, ours are protocol-layer.

8. Payman & Catena Labs

• Payman (verified payman.ai, fetched 2026-09-06): Pivoted from "humans pay AI agents" marketplace to "Agentic Banking" — white-label infrastructure that lets banks and credit unions (ICBA, Middlesex Federal, Citizens State Bank logos; Visa, Coinbase, Circle, SOC 2) deploy money-handling AI agents under bank control.
• Catena Labs: "AI-native financial institution" (a16z-backed, Agent Commerce Kit on USDC rails) — site unreachable today; status [UNVERIFIED], treat as possibly dormant/pivoted. Qals: The Payman pivot is the tell: agent payments are consolidating into regulated institutions. B-QALS being AU$1-reserve-backed prepaid credit is our answer to this — position Qals as the "agentic bank" with reserves, not an unlicensed network.

9. MCP payments (Model Context Protocol)

Verified (modelcontextprotocol.io, 2025-06-18 spec revision): The MCP spec contains no payment primitives — changes are OAuth resource-server hardening (RFC 8707), elicitation, structured tool output. Any later 2026 revision [UNVERIFIED]. Paid-tool monetisation in the wild is all layered on top: x402-with-MCP extensions, Stripe ACP's "REST and MCP compatible" checkout, Nevermined Commerce MCP, Coinbase AgentKit's MCP server extension. Qals: INTEROP: expose every paid Qals service (GPU compute, Qalx venues) as MCP tools that return an x402-style 402 when unpaid. Do not wait for MCP to standardise payments — the ecosystem has already voted with extensions.

10. Agent-economy crypto stacks: Virtuals, ElizaOS, NEAR

• Virtuals Protocol (Base): tokenised agents, per-agent wallet split (treasury/agent/facilitator), x402 support added to the agent toolkit late 2025; its own "Agent Commerce Protocol" (ACP — name now collides with Stripe's) [UNVERIFIED 2026 detail]. Study for token-incentive design; its speculative tokenomics is what Qals should AVOID.
• ElizaOS (ex-ai16z/Eliza): open-source agent framework with wallet plugins; integrates with AgentKit and x402 [UNVERIFIED 2026 detail]; suffered 2025 governance turmoil.
• NEAR Intents (verified near.org, fetched 2026-09-06): marketed as the "Universal Transaction Layer for the AI Economy" — solver-competition execution for cross-chain swaps/bridges/agent settlements; chain abstraction so agents don't manage bridges. Qals: NEAR-style intents are worth borrowing as a UX concept — Qals agents state an outcome ("buy 2 GPU-hours"), the escrow layer routes; we don't need their solvers.

11. Lightning: L402 → did it die into x402?

Verified (github.com/lightninglabs/L402, fetched 2026-09-06): Not dead — forked in concept, evolved in place. L402 remains a maintained open spec (48 commits; macaroon + invoice in WWW-Authenticate: L402, payment preimage as receipt; macaroon caveat attenuation = delegable sub-credentials) and now ships an Agent Specification written in ~560 tokens for LLM consumption. But adoption remains Lightning-niche vs x402's 75M txns/quarter. Qals: BORROW macaroon-style attenuated credentials: a Qals session token that a coordinating agent can derive down (scope to one GPU job, one budget) is a cleaner cap primitive than per-call signatures. Historical lineage note: x402 is the stablecoin generalisation of the 402 pattern L402 proved.

12. Australia: banks, RBA, AUD stablecoins

• RBA Project Acacia: joint RBA/DFCRC research on tokenised-money settlement (tokenised deposits + wholesale CBDC pilots with 20+ participants). Final report timing ~late 2025; "no retail CBDC" posture, pro tokenised-deposit interoperability [UNVERIFIED — RBA site paths 404 today; re-fetch rba.gov.au before citing]. Relevance: it legitimises exactly the "AU$-reserve-backed tokenised credit + off-chain legal rails" construction B-QALS uses.
• AUD stablecoins: AUDD (Audt, ex-Novatti) live B2B; ANZ A$DC bank-issued; Agora AUSD AUD expansion [UNVERIFIED]; a retail "AUDC" on Coinbase International [UNVERIFIED]. Cuscal provides AUD-stablecoin issuance/settlement rails to non-bank issuers (partner ecosystem incl. Stables) [UNVERIFIED 2026 detail].
• Bank agent pilots: no confirmed 2026 Australian bank agent-payment pilot found (fetch constraints) [UNVERIFIED]. Watch AUDD + Cuscal + RBA follow-ups. Qals: For an AU entity, B-QALS should track the AUDD/Cuscal issuance model (audited reserves, AUSTRAC posture) — it is the compliance template APRA/ASIC already recognise.

13. Standards watch: ERC-7702/7703, other drafts

• ERC-7702 (EOA⇄smart-account delegation) + ERC-7703 native AA: live since Pectra (May 2025, pre-2026 knowledge). Practical 2026 effect visible today: AgentKit "smart wallet" chatbots, Tempo's passkey smart accounts with batch/scheduled/gas-sponsored payments. Every agent wallet in 2026 is effectively a programmable account with session-keys/spend-limits — the industry's answer to "agents spending money" is delegated programmable accounts; Qals' Move objects are the native equivalent.
• Beyond x402: MPP (RFC 7235 Payment scheme), AP2 mandates, Web Bot Auth WG (RFC 9421), A2A for agent-to-agent transport, ACP for checkout. No W3C payment-specific agent draft found [UNVERIFIED].
• Stablecoin rails: USDC dominant on Base/Tempo/Solana; Tempo pushing USD/EURC.e; GENIUS Act-era US issuance normalised (2025) [pre-2026 knowledge]. Stripe membership in x402 Foundation + Tempo means Stripe is converging the crypto and card agentic stacks — assume both eventually interop and don't pick a loser.

Summary Table

The 5 things Qals should integrate (ranked)

1. An x402-compatible endpoint with a native B-QALS payment scheme — the de facto standard, Linux-Foundation-governed, with proven demand (75M txns/qtr at $0.32 avg — exactly GPU-compute ticket sizes). One middleware line for every paid Qals API; plus a USDC⇄B-QALS exchange leg so public agents can actually pay.
2. AP2-style mandate objects on-chain — Intent/Cart/Payment mandates as Move objects: budget, per-call cap, expiry, revocation enforced by the chain, not middleware. This is the differentiation every competitor (AgentKit's own README!) admits they lack.
3. Web Bot Auth / RFC 9421-signed agent identity at the HTTP edge — we're already on W3C VC + RFC 9421; make Qals agents first-class in the IETF Web Bot Auth directory so they're accepted, not 403'd, off-chain.
4. The MPP (WWW-Authenticate: Payment) header path alongside x402 — same endpoint, second protocol, aligned to AP2/card rails; cheap to add now that Nevermined has published the pattern, and it future-proofs us toward Tempo/Stripe interoperability.
5. AUDD/Cuscal-style reserve compliance + RBA Acacia vocabulary for B-QALS — audited AU$ reserves, tokenised-deposit framing, AUSTRAC/APRA posture. The 2026 market (Payman's bank pivot, Nevermined in "Agentic AI for Banking") rewards regulated-looking agent money.

Fetch log 2026-09-06: x402.org ✓, skyfire.xyz ✓, nevermined.io + /mpp ✓, tempo.xyz ✓, agenticcommerce.dev ✓, github.com/coinbase/agentkit ✓, modelcontextprotocol.io ✓, github.com/lightninglabs/L402 ✓, near.org/intents ✓, webbotauth.org ✓. Failed: ap2-protocol.com (DNS), google-agents-commerce/AP2 (404), docs.stripe.com/agentic-commerce-protocol (404), corporate.visa.com product+news (404), rba.gov.au acacia (404), catenalabs.com (unreachable), payman.ai ✓, DDG/Bing (bot-blocked/polluted).