x402 on Cardano and Midnight: how AI agents pay per request, and what stays private

x402 is an open standard that lets a program pay for a web request at the moment it makes it. A server answers with a price, the client pays on a blockchain and asks again with proof, and the server hands over what was asked for. Cardano now has an official x402 scheme, software packages and a hosted test facilitator, and the Cardano developer office hour scheduled for 6 October is about building with it. Midnight, the privacy-focused chain from the same ecosystem, has no x402 scheme of its own that we could find, but a community prototype shows what private agent payments could look like there.

This post explains the problem x402 addresses, how a payment works step by step, why Cardano's ledger suits it, what it costs and where it is limited, where the work stands today with dates, and where Midnight fits in. Where a point is our own reading rather than something a source states, we say so.

Paying software for software

Most paid services on the web are built for people: an account, an API key, a subscription, a card checkout. An AI agent that needs one dataset for a report, a short burst of computing power or a single translation has no checkout page to click through. Opening an account for each service defeats the point of automating the task.

The web has had a status code for this since the 1990s. HTTP 402, "Payment Required", was reserved and then almost never used. x402 gives it a defined meaning. It is governed by the x402 Foundation, which launched under the Linux Foundation on 2 April 2026 when Coinbase, which created the protocol, completed its contribution of it. According to Coinbase's developer documentation, 40 organisations joined at launch, among them Amazon Web Services, American Express, Cloudflare, Coinbase, Google, Mastercard, Shopify, the Solana Foundation, Stripe and Visa.

How an x402 payment works

Three parties take part. The client is the agent or app making the request. The resource server is the API that charges for it. The facilitator is an optional service that checks payments and submits them to the blockchain, so that the server does not have to run chain infrastructure of its own. A server can also verify and submit itself.

In version 2 of the specification the exchange runs like this:

1. The client asks for a resource.
2. The server answers with HTTP 402 and a PAYMENT-REQUIRED header: which networks and assets it accepts, the amount, who is paid, and how long the offer stays valid.
3. The client chooses an option, signs a payment and asks again, this time with a PAYMENT-SIGNATURE header.
4. The server has the payment checked, either itself or through the facilitator's /verify call, does the work, and has the payment submitted through /settle.
5. The server answers 200 with the resource and a PAYMENT-RESPONSE header that carries the transaction hash.

None of this is tied to one blockchain. The x402 repository holds 17 network-specific specifications for the exact scheme, meaning the client pays exactly the quoted amount. Cardano is one of them, next to EVM chains, Solana, Stellar, the XRP Ledger and others. There is no file for Midnight in that list.

Why Cardano's ledger suits it

Cardano uses the extended UTXO model, or eUTxO. A transaction spends specific unspent outputs, creates new ones, and is signed as a whole. Cardano's own glossary contrasts this with account-based chains, where an x402 payment is commonly made by granting a contract a spending allowance.

On Cardano the client builds a complete transaction that pays the exact quoted amount to the server's address, signs it, and does not broadcast it. The facilitator can only submit it unchanged. Cardano's developer portal puts it this way: the wallet signs the whole transaction, so the facilitator has nothing left to alter or co-sign. The facilitator's README says it never holds keys and never signs, and the specification says it does not even need a funded wallet.

Replay is handled by the ledger. The payment carries a nonce, a reference to one specific unspent output that the transaction spends. Once the transaction lands, that output no longer exists, so the same payment cannot be accepted twice.

Before submitting, a facilitator has to run nine checks:

• the network is the right one (mainnet, preprod or preview);
• one output pays the address in the offer;
• the amount is at least the quoted one;
• the asset is exactly the quoted one, not another asset of equal market value;
• the nonce output is still unspent;
• the transaction obeys the ledger's own rules, including that value in equals value out plus the fee;
• it has not expired, with an expiry no later than the offer's timeout allows, so an unused signed payment dies by itself;
• the payment output meets the protocol's minimum;
• the required number of confirmations has been reached before the resource is released.

The client pays the network fee. The specification says fee sponsorship, where the facilitator pays on the client's behalf, is not supported in this version.

Three ways to pay on Cardano

Cardano's scheme defines three transfer methods.

Address to address is the plain case: the payment goes to the server's address, as on other chains.

Masumi escrow locks the funds in a contract instead. Masumi describes itself as a payment network for AI agents, with escrow contracts on Cardano, an on-chain registry of agents and their track records, and logging of each step in a chain of agents. Its contract, called vested_pay, holds the money while the seller delivers and can release it or refund it. x402 only covers the first step. The specification is explicit that it performs the lock, and that release, refund and dispute belong to the contract and the Masumi Payment Service.

Script payments lock funds into any contract the server defines, with an optional datum, the data that contract expects. x402 cannot judge whether that datum is right for the contract. The specification says the server owns its correctness, and that a wrong or missing datum can strand the funds.

What it costs, and what limits it

Pricing. Cardano's glossary names two stablecoins for x402 payments: USDM, a US-dollar-pegged token issued by Moneta, and Djed, a crypto-backed, overcollateralised one. In the specification's own example, which is illustrative, a request costs 10,000 units of USDM, and because USDM has six decimals that is 0.01 USDM, one cent.

A floor on every payment. Every Cardano output must carry a minimum amount of ADA, and the minimum grows with the output's size. For a payment in a token such as USDM the specification puts it at roughly 1.2–1.5 ADA. That ADA is sent in addition to the token, comes from the payer's inputs, and travels with the token to the recipient. Our reading: a one-cent request therefore still moves more than one ADA alongside it, which makes very small payments heavier here than on chains without such a floor.

Speed and finality. Cardano produces a block about every 20 seconds, the default confirmation setting is one block, and the specification's example offers a 600-second window. A settle call can return settlement_pending and be resumed. The specification also notes that Cardano's consensus has probabilistic finality, so a transaction seen in the mempool or a recent block can still be rolled back. It calls releasing the resource at mempool inclusion "strongly discouraged" for anything of real value.

Where it stands

The timeline, with sources:

• 2 April 2026: the x402 Foundation launches under the Linux Foundation (Coinbase's developer documentation).
• 23 April 2026: Masumi announces on X that the foundation merged the pull request adding a Cardano specification and that Cardano is now officially an x402 chain; the Cardano Foundation posted the same day that it and Masumi had worked on the adoption. Blockchain.News reported the same date.
• 18 September 2026: the @x402/cardano package is first published to npm as version 2.26.0. Version 2.28.0 followed on 29 September, so the code is moving quickly.
• 22 September 2026: the Cardano developer portal merges an x402 page and two templates, an Express seller API with a buyer agent and a Next.js paywall that uses a browser wallet. Both run on the preprod test network with test ADA and test USDM, and the pull request says they were verified end to end there.
• 5 October 2026: the portal publishes the Cardano Foundation's hosted preprod facilitator address, and the page also lists a mainnet one.
• 6 October 2026, 08:00 UTC: a Cardano developer office hour, "Build, Pay, Automate with x402", is scheduled for participants in the TOKEN2049 hackathon, according to a post from Cardano relayed by KuCoin News.

A Python implementation was an open pull request on the x402 repository when we read it.

What this does not yet show is a live mainnet payment. The facilitator's README says earlier versions were proven on the preprod test network and that the current version, which verifies against the chain differently, has not repeated a live proof on mainnet. We found no published record of a mainnet x402 payment on Cardano.

The privacy gap

An x402 payment on a public chain is public. A BEX analysis published on 29 August 2026, about an approach on EVM chains, describes how a competitor may be able to correlate the payer's wallet, the recipient, the amount, the time and the service being bought, and how repeated payments can expose supplier relationships, budgets and strategy. Our reading: a Cardano x402 payment is an ordinary transaction on a public ledger, so the same exposure applies. Nothing in the Cardano scheme hides who pays.

Where Midnight comes in

Midnight is a privacy-focused blockchain developed by Input Output, the company behind much of Cardano. It uses zero-knowledge proofs so that an application can show that rules were followed without revealing the data behind them. The two networks are linked: NIGHT, Midnight's token, launched on 4 December 2025 as a Cardano native asset.

Midnight's documentation draws a line that matters for payments. NIGHT is unshielded, so its balances and transfers are always public. DUST, the resource that pays transaction fees, is shielded and cannot be transferred; holding NIGHT generates it. Privacy comes from the type of token, and there is no way to move a token between the shielded and unshielded kinds. A payment in plain NIGHT would be as visible as one on Cardano. Hiding the payer takes a design built for it.

One such design exists, as a community project. Shade402 is a prototype by an independent developer, tagged for a Midnight buildathon. Its repository was created on 31 August 2026 and last updated on 25 September, and its contract runs on Midnight's Preview test network. It works like this:

• Each agent is represented on chain by a single commitment, a hash of a secret the agent holds.
• To pay an invoice, the agent proves in zero knowledge that it is a registered member, that the invoice has not been paid before, that the recipient is on the owner's allowlist, and that its private balance and spending limits allow the payment.
• The contract then pays the provider with an ordinary public transfer.

The provider sees that the Shade402 contract paid, not which agent. Hidden are the agent's identity and its balance and limits. Public by design are the amounts, the providers, the invoice hashes and the totals.

Its author lists the limits plainly. It is a single-custodian demo: the backend holds the wallet and the agent secret. The x402 provider is simulated. There is no rate limiting. Anonymity is weak until many agents have registered, because a payment only proves that some registered agent paid. Registration itself is visible, and amounts are public. The author plans to remove the custodian and to add shielded settlement once Midnight supports it.

Our reading: the two chains work on different halves of the problem. Cardano's work standardises how a payment is formed, checked and settled. A Midnight design such as Shade402 is aimed at hiding who pays. They are not integrated, and we found no announced x402 scheme from Midnight's foundation or from Input Output.

Risks and open questions

• No mainnet record yet. The portal's templates run on a test network, and the facilitator's own README says live mainnet proof has not been repeated for the current version.
• The facilitator is a trusted operator, within limits. It cannot move funds beyond what the client signed, but it can verify slowly, refuse, or go offline. The hosted one is run by one organisation. That is our reading of the design.
• Server-defined scripts can strand money. The specification places datum correctness on the server, with no guard.
• The standard is young. Package versions moved from 2.26.0 to 2.28.0 in eleven days, and details in the Cardano scheme may still change.
• Private payments are a prototype. Shade402 is a Wave 1 test-network project with a custodian, not a service.
• Open questions: whether servers will accept one confirmation or insist on more; how sellers deal with the minimum-ADA floor on tiny payments; and whether Midnight's teams will publish a scheme of their own.