Agentic Commerce Beyond The Checkout: Building with Machine Payments

Agentic commerce is a big idea, but what exactly does it mean? And how can we get started building it?

This talk focuses on one concrete primitive: the paid HTTP request. We’ll introduce the Machine Payments Protocol (MPP), show how 402 Payment Required can become a machine-readable payment challenge, and walk through the lifecycle from unpaid request to verified settlement and returned resource.

Transcript

1. PAY → Paul Conroy / @conroyp 402 → Building with Machine Payments → Agentic Commerce Beyond The Checkout GET 200
2. Paul Conroy 🇮🇪 From Dublin, Ireland 👴 Started playing with the web 30+ years ago (Notepad, table layouts, spacer GIFs, & FTP deploys!) CTO at Square1 🌍 conroyp.com / @conroyp
3. Agentic commerce is having a moment
7. What does it mean? An agent finds a price. It decides to buy. It completes the transaction under some authority: a wallet, a mandate, a token, or a human approval.
8. What does it mean? An agent finds a price. It decides to buy. It completes the transaction under some authority: a wallet, a mandate, a token, or a human approval. A shopping assistant buys you a jacket A research agent unlocks one dataset A coding agent pays for a single API call
9. What does it mean? An agent finds a price. It decides to buy. It completes the transaction under some authority: a wallet, a mandate, a token, or a human approval. A shopping assistant buys you a jacket A research agent unlocks one dataset A coding agent pays for a single API call 🚨 The buyer can no longer be assumed to be a person in a browser 🚨
10. Which layer do you need? COMMERCE PROTOCOLS (UCP) • Implement agreed endpoints. • Assistant is the shopfront. • Platform gatekeepers! PAYMENT PRIMITIVES (MPP, x402) • A resource, a price, and a way for a machine to pay. • Agent needs to discover your routes and payment options.
11. Which layer do you need? COMMERCE PROTOCOLS (UCP) • Implement agreed endpoints. • Assistant is the shopfront. • Platform gatekeepers! PAYMENT PRIMITIVES (MPP, x402) • A resource, a price, and a way for a machine to pay. • Agent needs to discover your routes and payment options.
12. 402 Payment Required
13. 402: A Brief History 1997 2020 HTTP/1.1 → L402 over Lightning reserves 402 2025 2026 → Coinbase ships x402 Machine → Payments Protocol
14. The whole protocol, in one exchange THE AGENT OUR API
15. The whole protocol, in one exchange THE AGENT OUR API 1. GET /resource
16. The whole protocol, in one exchange THE AGENT OUR API 1. 2. GET /resource 402 + signed challenge · price · expiry · rail
17. The whole protocol, in one exchange THE AGENT OUR API 1. 2. 3. Obtains a payment artefact: a token, or a signed transfer GET /resource 402 + signed challenge · price · expiry · rail
18. The whole protocol, in one exchange THE AGENT OUR API 1. 2. GET /resource 402 + signed challenge · price · expiry · rail 3. Obtains a payment artefact: a token, or a signed 4. transfer GET /resource + Authorization: Payment
19. The whole protocol, in one exchange THE AGENT OUR API 1. 2. GET /resource 402 + signed challenge · price · expiry · rail 3. Obtains a payment artefact: a token, or a signed 4. transfer GET /resource + Authorization: Payment Verifies settlement on the rail, then serves resource
20. The whole protocol, in one exchange THE AGENT OUR API 1. 2. GET /resource 402 + signed challenge · price · expiry · rail 3. Obtains a payment artefact: a token, or a signed 4. transfer GET /resource + Authorization: Payment 5. 200 + resource + Payment-Receipt Verifies settlement on the rail, then serves resource
21. “... verifies settlement on the rail”
22. “... verifies settlement on the rail” The protocol never says how money moves. A challenge names its rail and the client answers exactly one.
23. “... verifies settlement on the rail” The protocol never says how money moves. A challenge names its rail and the client answers exactly one. Lightning Bitcoin micropayments over payment channels USDC on Base / Solana USDC transfers, verified on-chain. Tempo Stripe pathUSD stablecoin on Tempo blockchain Shared Payment Tokens - card, wallets, Link
24. “... verifies settlement on the rail” The protocol never says how money moves. A challenge names its rail and the client answers exactly one. Lightning Bitcoin micropayments over payment channels USDC on Base / Solana USDC transfers, verified on-chain. Tempo Stripe pathUSD stablecoin on Tempo blockchain Shared Payment Tokens - card, wallets, Link
25. Anatomy of a 402 challenge $ curl -si https://www.payforgoals.com/api/v1/scores/match/1 HTTP/2 402 Payment Required WWW-Authenticate: Payment id="zN3AD07Vo2…", realm="www.payforgoals.com", method="stripe", request="eyJhbW91bnQi…", expires="2026-09-04T09:19:10Z", opaque="eyJub25jZSI6…" WWW-Authenticate: Payment id="Tz…", method="tempo", … One challenge per rail The client can pick one A short expiry Prices only valid for a short window Request terms How much? How to pay? Payment ID An HMAC over every field.
26. Anatomy of a 402 challenge $ curl -si https://www.payforgoals.com/api/v1/scores/match/1 HTTP/2 402 Payment Required WWW-Authenticate: Payment id="zN3AD07Vo2…", realm="www.payforgoals.com", method="stripe", request="eyJhbW91bnQi…", expires="2026-09-04T09:19:10Z", opaque="eyJub25jZSI6…" WWW-Authenticate: Payment id="Tz…", method="tempo", … One challenge per rail The client can pick one A short expiry Prices only valid for a short window Request terms How much? How to pay? Payment ID An HMAC over every field.
27. Anatomy of a 402 challenge $ curl -si https://www.payforgoals.com/api/v1/scores/match/1 HTTP/2 402 Payment Required WWW-Authenticate: Payment id="zN3AD07Vo2…", realm="www.payforgoals.com", method="stripe", request="eyJhbW91bnQi…", expires="2026-09-04T09:19:10Z", opaque="eyJub25jZSI6…" WWW-Authenticate: Payment id="Tz…", method="tempo", … One challenge per rail The client can pick one A short expiry Prices only valid for a short window Request terms How much? How to pay? Payment ID An HMAC over every field.
28. Anatomy of a 402 challenge $ curl -si https://www.payforgoals.com/api/v1/scores/match/1 HTTP/2 402 Payment Required WWW-Authenticate: Payment id="zN3AD07Vo2…", realm="www.payforgoals.com", method="stripe", request="eyJhbW91bnQi…", expires="2026-09-04T09:19:10Z", opaque="eyJub25jZSI6…" WWW-Authenticate: Payment id="Tz…", method="tempo", … One challenge per rail The client can pick one A short expiry Prices only valid for a short window Request terms How much? How to pay? Payment ID An HMAC over every field.
29. Anatomy of a 402 challenge $ curl -si https://www.payforgoals.com/api/v1/scores/match/1 HTTP/2 402 Payment Required WWW-Authenticate: Payment id="zN3AD07Vo2…", realm="www.payforgoals.com", method="stripe", request="eyJhbW91bnQi…", expires="2026-09-04T09:19:10Z", opaque="eyJub25jZSI6…" WWW-Authenticate: Payment id="Tz…", method="tempo", … One challenge per rail The client can pick one A short expiry Prices only valid for a short window Request terms How much? How to pay? Payment ID An HMAC over every field.
30. Anatomy of a 402 challenge $ curl -si https://www.payforgoals.com/api/v1/scores/match/1 HTTP/2 402 Payment Required WWW-Authenticate: Payment id="zN3AD07Vo2…", realm="www.payforgoals.com", method="stripe", request="eyJhbW91bnQi…", expires="2026-09-04T09:19:10Z", opaque="eyJub25jZSI6…" WWW-Authenticate: Payment id="Tz…", method="tempo", … One challenge per rail The client can pick one A short expiry Prices only valid for a short window Request terms How much? How to pay? Payment ID An HMAC over every field.
31. Inside the request data method="stripe", request="eyJhbW91bnQi…", { "amount": "100", "currency": "usd", "methodDetails": { "networkId": "profile_61Ut…", "paymentMethodTypes": ["card"] } }
32. Inside the request data method="stripe", request="eyJhbW91bnQi…", method="tempo", request="Txsd78abojs79…", { { "amount": "1000000", "currency": "0x20c000…0000", "methodDetails": { "chainId": 42431, "memo": "0xd02e…", "supportedModes": ["pull"] }, "recipient": "0x0dcd39…ABF70" "amount": "100", "currency": "usd", "methodDetails": { "networkId": "profile_61Ut…", "paymentMethodTypes": ["card"] } } }
33. The paid retry $ curl -si https://www.payforgoals.com/api/v1/scores/match/1 \ -H "Authorization: Payment eyJjaGFsbGVuZ2UiOnsiaWQiOi…" Decoded: { "challenge": { …every header param, echoed back untouched… }, "payload": { "spt": "spt_1U1M…" } } • Same challenge returned • Add rail-specific payment details
34. Paid response, with receipt HTTP/2 200 OK Payment-Receipt: eyJzdGF0dXMiOiJzdWNjZXNzIi… { "tier": "pay-per-view", "report": { "quarter": "2026-Q3", "pages": 42, … } }
35. Paid response, with receipt HTTP/2 200 OK Payment-Receipt: eyJzdGF0dXMiOiJzdWNjZXNzIi… { "tier": "pay-per-view", "report": { "quarter": "2026-Q3", "pages": 42, … } } // eyJzdGF0dXMiOiJzdWNjZXNzIi decoded: { "status": "success", "method": "stripe", "reference": "pi_3Qx8…", "timestamp": "2026-09-18T15:01:12Z" }
36. Paid response, with receipt HTTP/2 200 OK Payment-Receipt: eyJzdGF0dXMiOiJzdWNjZXNzIi… { "tier": "pay-per-view", "report": { "quarter": "2026-Q3", "pages": 42, … } } // eyJzdGF0dXMiOiJzdWNjZXNzIi decoded: { "status": "success", "method": "stripe", "reference": "pi_3Qx8…", "timestamp": "2026-09-18T15:01:12Z" } reference is the settlement ref Stripe: PaymentIntent id Tempo: on-chain tx hash Receipt is base64url JSON, auditable on both sides.
37. Ask for one rail $ curl -si https://www.payforgoals.com/api/v1/scores/match/1 \ -H 'Accept-Payment: stripe/charge' HTTP/2 402 Payment Required WWW-Authenticate: Payment id="…", method="stripe", … // Rank instead of filter: Accept-Payment: stripe/charge, tempo/charge;q=0.3
38. 402 Pay up
39. 200 Paid!
40. 200 Paid! …but how?
41. Backend application flow 🧑💻 Verify the request • HMAC altered? • Payment for different route? • Offer expired? • Signature checks out?
42. Backend application flow 🧑💻 Verify the request • HMAC altered? • Payment for different route? • Offer expired? • Signature checks out?
43. Backend application flow 🧑💻 Verify the request • HMAC altered? • Payment for different route? • Offer expired? • Signature checks out?
44. Backend application flow 🧑💻 Verify the request • HMAC altered? • Payment for different route? • Offer expired? • Signature checks out? Create a settlement lock Don’t process the same request twice
45. Backend application flow 🧑💻 Verify the request • HMAC altered? • Payment for different route? • Offer expired? • Signature checks out? Create a settlement lock Don’t process the same request twice Settle on the rail
46. Backend application flow 🧑💻 Verify the request • HMAC altered? • Payment for different route? • Offer expired? • Signature checks out? Create a settlement lock Don’t process the same request twice Settle on the rail
47. Backend application flow 🧑💻 Verify the request • HMAC altered? • Payment for different route? • Offer expired? • Signature checks out? Create a settlement lock Don’t process the same request twice Settle on the rail
48. Backend application flow 🧑💻 Verify the request • HMAC altered? • Payment for different route? • Offer expired? • Signature checks out? Serve response & receipt Create a settlement lock Don’t process the same request twice Settle on the rail
49. Wait - where is the card stored in all of this?
50. Wait - where is the card stored in all of this?
51. The Shared Payment Token { "id": "spt_1RxT…", "object": "shared_payment .granted_token", "usage_limits": { "currency": "usd", "max_amount": 100, "expires_at": 1757442300 }, "payment_method": "pm_…", "seller_details": { "network_business_profile": "pr…" } • Single-purpose credential • Minted from a saved card • Revocable! • The token travels, but the card never does. } https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens
52. The Shared Payment Token { "id": "spt_1RxT…", "object": "shared_payment .granted_token", "usage_limits": { "currency": "usd", "max_amount": 100, "expires_at": 1757442300 }, "payment_method": "pm_…", "seller_details": { "network_business_profile": "pr…" } Limitations on: • Specific business • Spending cap • Expiry date } https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens
53. Where the SPT comes from 🧑💻
54. Where the SPT comes from 🧑💻 💳
55. Where the SPT comes from 🧑💻 💳
56. Where the SPT comes from 🧑💻 💳
57. Where the SPT comes from 🧑💻 🤖 💳
58. Where the SPT comes from 🧑💻 🤖 💳
59. Where the SPT comes from 🧑💻 🤖 💳 Shared Payment Token 🎟
60. Where the SPT comes from 🧑💻 🤖 💳 Shared Payment Token 🎟 🎟
61. Where the SPT comes from 🧑💻 🤖 💳 🎟 Shared Payment Token 🎟 🎟
62. Where the SPT comes from 🧑💻 🤖 💳 🎟 Shared Payment Token 🎟 🎟
63. Where the SPT comes from 🧑💻 🤖 💳 💵 Shared Payment Token 🎟 🎟 🎟
64. Where the SPT comes from 🧑💻 🤖 💳 💵 Shared Payment Token 🎟 The merchant never sees the card! 🎟 🎟
65. Stripe: You Make The Charge The buyer's wallet grants a scoped token (SPT) ↓ The agent retries your route with the SPT ↓ Your server creates and confirms a PaymentIntent ↓ Stripe reports success ↓ Serve the resource. Receipt ref = pi_…
66. Stripe: You Make The Charge The buyer's wallet grants a scoped token (SPT) ↓ The agent retries your route with the SPT ↓ Your server creates and confirms a PaymentIntent ↓ Stripe reports success ↓ Serve the resource. Receipt ref = pi_… The token is not the payment. It is permission to charge, inside limits. You still create the charge, and you still verify the challenge. Card economics apply. Price in dollars, not microcents!
67. Tempo: You Validate It The agent signs a pathUSD transfer for this challenge ↓ Agent retries your route with the signed transaction ↓ Your server validates it, then broadcasts it ↓ The chain confirms ↓ Serve the resource. Receipt ref = transaction hash The payment arrives signed. The agent commits the money. Our job is to check the transfer matches the challenge, then confirm it settles on-chain. No card minimums. Onecent prices work.
68. PayForGoals.com
69. PayForGoals.com HTTP/2 200 OK Payment-Receipt: eyJzdGF0dXMiOiJzdWNjZXNzIi… { "tier": "pay-per-view", "scoreline": { "id": 1, "away_score": 7, "home_score": 1, "year": 2014, "teams": null } } MPP playground Supports Stripe & Tempo Test cards & testnet!
70. PayForGoals.com HTTP/2 200 OK Payment-Receipt: eyJzdGF0dXMiOiJzdWNjZXNzIi… { "tier": "pay-per-view", "scoreline": { "id": 1, "away_score": 7, "home_score": 1, "year": 2014, "teams": null } } MPP playground Supports Stripe & Tempo Test cards & testnet! Team names in v2 (mvp…)
71. PayForGoals.com HTTP/2 200 OK Payment-Receipt: eyJzdGF0dXMiOiJzdWNjZXNzIi… { "tier": "pay-per-view", "scoreline": { "id": 1, "away_score": 7, "home_score": 1, "year": 2014, "teams": null } } MPP playground Supports Stripe & Tempo Test cards & testnet! Team names in v2 (mvp…)
72. Live Demo 402 PAY 200
73. Live Demo 402 PAY 200
74. What just happened? 402 The server minted a signed challenge Price + rail + expiry, bound to that resource PAY The agent produced a payment artefact A Shared Payment Token, a signed transfer (no checkout page!) 200 The server verified settlement, then served Receipt ref → PaymentIntent id / transaction hash
75. Charging for a 404? $ curl -si https://www.payforgoals.com/api/v1/scores/match/9999999 \ -H "Authorization: Payment eyJjaGFsbGVuZ2UiOnsiaWQiOi…" HTTP/2 404 Resource Not Found
76. Charging for a 404? $ curl -si https://www.payforgoals.com/api/v1/scores/match/9999999 \ -H "Authorization: Payment eyJjaGFsbGVuZ2UiOnsiaWQiOi…" HTTP/2 404 Resource Not Found 402 → PAY → 404 The customer paid to learn the thing does not exist!
77. Charging for a 404? $ curl -si https://www.payforgoals.com/api/v1/scores/match/9999999 \ -H "Authorization: Payment eyJjaGFsbGVuZ2UiOnsiaWQiOi…" HTTP/2 404 Resource Not Found 402 → PAY → 404 The customer paid to learn the thing does not exist! • Run a pre-qualifying function before returning 402. • Only suitable if the lookup itself isn’t costly! (inference costs etc)
78. Can you make that any easier for me? square1-io/laravel-mpp
79. Pay to skip the queue HTTP/2 429 Too Many Requests Retry-After: 3600
80. Pay to skip the queue HTTP/2 429 Too Many Requests Retry-After: 3600 WWW-Authenticate: Payment id="zN3AD07Vo2…", realm="www.payforgoals.com", method="stripe", request="eyJhbW91bnQi…", expires="2026-09-04T09:19:10Z", opaque="eyJub25jZSI6…"
81. Pay to skip the queue HTTP/2 42902 Too Many Requests - but maybe.. Retry-After: 3600 WWW-Authenticate: Payment id="zN3AD07Vo2…", realm="www.payforgoals.com", method="stripe", request="eyJhbW91bnQi…", expires="2026-09-04T09:19:10Z", opaque="eyJub25jZSI6…"
82. Pay to skip the queue HTTP/2 42902 Too Many Requests - but maybe.. Retry-After: 3600 WWW-Authenticate: Payment id="zN3AD07Vo2…", realm="www.payforgoals.com", method="stripe", request="eyJhbW91bnQi…", expires="2026-09-04T09:19:10Z", opaque="eyJub25jZSI6…" { "detail": "Free tier exhausted. Retry in 3600s or skip the queue for $3.50." }
83. How do agents find you? /openapi.json List priced routes Accepted payment rails listed Automatically update on change
84. How do agents find you? OpenAPI.json file on your domain Publish x-payment-info per route: method, intent, amount, currency. Agents read the menu when asked to investigate your site. Directories mpp.dev lists MPP-enabled services. Connect to the MCP server - agents search, find a price, pay, and call. A human tells them! “I want to buy ABC from example.com. Find out how much it costs and come back for approval.”
85. The EMEA Reality Check
86. The EMEA Reality Check Live SPT buyer flows are US-only today The Link-wallet buyer side has not opened up here yet Stripe seller flows are now enabled in EMEA and test mode is available globally, covering the buyer side! Tempo mainnet is live, from anywhere No geo-gate. For teams outside the US: seller rails are (mostly) open, buyer rails half-there. Build the server side once, and both rails are ready.
87. 402 Payment Required
88. 200 OK
89. 💶 💵 💰 200 💸 OK
90. Thank you! payforgoals.com github.com/square1-io/laravel-mpp mpp.dev @conroyp · conroyp.com