An AI agent just got something close to a bank card — a virtual one, with its own spending limit. At Cloudflare Connect on October 20, Mastercard opened early developer access to Agent Pay for Machines, letting software settle payments with other software without a human clicking approve at every step.
The system runs on x402, a protocol built by Coinbase and named after the old HTTP status code 402, "Payment Required." That code used to just mean "come back with cash." Now an agent attaches a signed payment voucher to the same request and gets through in seconds. Coinbase's developer platform supplies the agent's wallet, the Ethereum layer-2 network Base settles transactions on-chain, and BVNK — the stablecoin infrastructure firm Mastercard bought in August for $1.8 billion — routes fiat or stablecoin funds through its Global Money Platform.
In the live demo, an agent working for marketing agency Hype was handed a budget and a brief: plan a launch campaign for a protein bar. It bought audience research from startup AIsa, ordered eight campaign images through Cloudflare's AI Gateway, and paid two vendors across nine separate transactions — all inside its budget, with no manual approval on a single payment.
Mastercard frames the leap in three steps: the web taught software to talk, APIs let it use other software's services, and now agents need a way to pay for them. For now this stays a pilot — only APIs, an SDK and a sandbox are open, following earlier trials with Cloudflare, Ant International, AWS and BVNK. The harder question — who is liable when an agent pays the wrong vendor or blows past its limit — is one Mastercard hasn't answered yet; it says only that feedback from this round will shape the real rollout.
