selling to AI agents over HTTP 402: x402 with Stripe holding the money

The request flow behind x402 on skillbay: a 402 with a Stripe deposit address, a signed USDC transfer, a facilitator, and a PaymentIntent. No wallets anywhere on the marketplace.

Nick Khami · September 16, 2026 · 4 min read

An AI agent cannot fill in a checkout form. It can, however, sign a payment authorization and retry an HTTP request. That is what x402 standardizes: a server answers 402 Payment Required with a price and an address, the agent pays, and the same request goes through. skillbay uses it for paid skill packages and for its catalog snapshot, and since February 2026 Stripe can be the party that receives the money. This post is the whole flow, as it runs on skillbay today.

TL;DR #

• GET /api/v1/skills/<slug>/download on a paid skill returns 402 with a PAYMENT-REQUIRED header (base64 JSON, also in the body): the exact USDC amount, the USDC contract on Base, and an address to pay.
• The address belongs to Stripe. It is a crypto deposit address created with one API call. USDC sent there is off-ramped into the Stripe balance, and each settled payment is recorded as a PaymentIntent with a transfer to the seller, so it refunds, reports, and pays out like a card sale.
• No seller on skillbay holds a wallet. skillbay holds no wallet either.

The request flow #

1. The agent asks for the file with no payment. The server answers 402. The header decodes to something like this:

{
  "x402Version": 2,
  "error": "PAYMENT-SIGNATURE header is required",
  "resource": { "url": "https://skillbay.sh/api/v1/skills/csv-cleaner/download", "mimeType": "application/zip" },
  "accepts": [{
    "scheme": "exact",
    "network": "eip155:8453",
    "amount": "5000000",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "payTo": "0x…",
    "maxTimeoutSeconds": 300,
    "extra": { "name": "USD Coin", "version": "2" }
  }]
}

amount is in USDC atomic units, six decimals, so 5000000 is five dollars.

2. The agent signs an EIP-3009 transferWithAuthorization for exactly that amount to that address and retries with a PAYMENT-SIGNATURE header carrying the signed payload. Any x402 client library does this; the agent needs a wallet on Base with USDC in it.

3. The server hands the payload to a facilitator, which checks the signature and then submits the transfer on-chain, paying the gas. skillbay uses PayAI's public facilitator by default; it needs no account.

4. Once the transfer is confirmed, the server tells Stripe about it: a PaymentIntent in transaction_verification mode with the transaction hash, a destination transfer to the seller's connected account, and no application fee. Stripe verifies the transaction on-chain and books the sale.

5. The server returns the zip with a PAYMENT-RESPONSE header holding the settlement details. A wallet that has paid once can fetch the same file again without paying.

Why Stripe and not a wallet #

The obvious way to receive x402 payments is to put your own address in payTo. Then you are a crypto treasury: you hold USDC, you off-ramp it, you reconcile it against sales by hand, and every seller on a marketplace needs their own address too.

Stripe's machine payments feature removes all of that. POST /v1/crypto/deposit_addresses with network=base returns an address Stripe watches. Whatever arrives there becomes balance in the account, refundable from the dashboard, and, through Connect, transferable to sellers exactly like card revenue. The only thing you keep is the transaction hash, and Stripe verifies that itself.

Two caveats as of this writing. The feature is a preview API version, and stablecoin payments are enabled per account after a request in the dashboard (US businesses outside New York, and thirty-odd other countries by asking). Stripe's own guide points the facilitator step at Coinbase's developer platform, but any facilitator works, because Stripe only needs the resulting on-chain transaction.

What buyers need #

A wallet on Base with USDC, and a client that speaks x402 v2. Coinbase's x402 packages, PayAI's client, Privy's wrapFetchWithPayment, and Stripe's purl command line tool all do. The agent should tell its user the price before paying; the listing's priceCents field and the 402 body both carry it.

The catalog in one call #

GET https://skillbay.sh/api is a second x402 resource: every approved skill in one JSON document, including the SKILL.md text of free skills and each paid skill's payment offer. It costs a dollar in USDC and a paying wallet can refetch it for a day. The per-skill endpoints under /api/v1 stay free, so nobody has to pay to browse.

Frequently asked questions #

Does the seller see crypto? No. The seller sees a sale in their Stripe Express dashboard and a payout in dollars.

What about refunds? A refund is a normal Stripe refund on the PaymentIntent. The download for that wallet is revoked the same way a card refund revokes it.

Can an agent buy without a wallet? Yes: through the MCP server, the agent signs the user in with OAuth and gets a Stripe Checkout link to pay by card.

Where is the code? The x402 handling on skillbay is about three hundred lines on top of Hono: a 402 builder, a facilitator client with verify and settle, and the PaymentIntent call. Stripe's x402 guide has the equivalent in their starter repo.

x402 · stripe · agents · payments