AI agent payments in production: an agent bought a gift card over x402, with no custodian

Google's Agent Payments Protocol names the three worries well: authorization, authenticity and accountability ^[3]. Did the user really allow this purchase? Does the request match what the user meant? Who answers when something goes wrong? Google says it is working with more than 60 organizations on those questions ^[3].

Card networks and platforms tend to answer with signed mandates and a trusted intermediary. That works when a regulated company sits in the middle. It also means the company holds the funds, or at least the keys to move them.

x402 starts from the other end. A server answers a request with HTTP 402, and the client pays and retries ^[1]. The standard describes itself as open and neutral, with zero protocol fees ^[1]. Its own site publishes live counts of transactions, buyers and sellers ^[1]. So the rail for AI agent payments exists. The open question is what sits at the receiving address.

There is a quieter point too. A budget is easier to reason about than a permission. An owner who funds an agent with a small amount knows the worst case in advance. No policy engine has to be trusted to enforce it, because the chain already does.

In most x402 setups the pay-to address belongs to the seller. For a gift card that would be us, and we would be holding customer money between the agent and the card provider. We did not want that, even for a minute.

So each order gets its own small contract. Its address is worked out before the contract exists. Every term is part of that address: where the money may go, how much, who gets a refund, and when the offer ends. Change one term and you get a different address.

This is the part people find odd, so it is worth saying slowly. The agent pays an address where nothing lives yet. A relayer then deploys the contract to exactly that address, and deploying it is what moves the money. Anyone can check the result: the same terms always produce the same address.

The contract can do three things. It can bridge the USDC to the card provider. It can pay the quoted service fee. It can send everything back to the payer once the deadline passes. It has no owner and no admin key, so we cannot redirect it either.

The payment itself is an ordinary signed USDC authorization. ERC-3009 lets a holder sign a transfer and lets someone else submit it and pay the gas ^[2]. That is why the agent needs no gas token, only USDC. The standard uses random 32-byte nonces, so one signed payment can never be used twice ^[2].

The agent pays on Base. The card provider accepts USDC on Ethereum. Something has to carry the money across, and that step is where custody usually sneaks back in.

Here the contract burns the USDC through Circle's Cross-Chain Transfer Protocol. Circle describes CCTP as native burn-and-mint, without traditional bridge liquidity pools ^[4]. The mint address is fixed inside the contract as the provider's deposit address, so the new USDC can only appear there.

Circle lists Fast Transfer at roughly 8 to 20 seconds ^[4]. In our production run the burn on Base happened 12 seconds after the agent paid ^[6], and the mint on Ethereum followed within the same minute. You can read more about this rail on our bridge page.

If the price expires before the money can be forwarded, the same contract refunds the agent in full. Nobody has to file a ticket. The rule is in the code that holds the money.

AI agent payments need brakes that the agent cannot release. The hard limit is simple: the agent can only spend the USDC at its own address. On top of that, the owner sets a per-card limit and a monthly limit in the app, per agent. One tap pulls the remaining balance home.

The card is always issued to the owner. The agent cannot send a name, and a request that tries is refused. Card codes stay hidden from the agent unless the owner turns that on. A code is money in plain text, and an agent's logs are not a safe place for it.

Gift cards attract fraud, so the caps matter. The Federal Trade Commission puts it bluntly: gift cards are for gifts, not for payments ^[5]. It also warns that no real business or government agency will ever tell you to buy a gift card to pay them ^[5]. An agent with a small budget and a monthly ceiling cannot be talked into draining a wallet.

Refusals are free. If the agent is over a limit, unknown, or switched off, the store says so before any payment settles.

Payments fail in boring ways, and AI agent payments fail in the same ones. A reply gets lost. A price expires. A bridge is slow. The design has an answer for each, and none of them needs a person.

If the agent pays and hears nothing back, it polls the status link. If it pays the same order again, the store answers with the same order and charges nothing. If the facilitator times out, the store keeps that payment reserved and reads the chain to see whether the money arrived.

If the deadline passes first, the contract refunds the agent in full when it is deployed. If the owner freezes the wallet or switches gift cards off, the next quote is refused before any payment settles. We wrote a test for each of these, and each test fails when its safeguard is removed.

Live now: an owner's own agent can buy gift cards for the USA and Canada, within the owner's limits. Any stock x402 client works, once its own spend cap is raised above the card's price. Expect about five minutes per card, and poll the status link instead of paying twice.

No agent of your own? Inside the app, Copilot does the same job with you in the loop. Ask it for a card and it finds the real product in your country. It fills in the amount and opens the review screen. Copilot only prepares, and your device signs, every time. If the card is not sold at the value you asked for, it picks the nearest real value and tells you. The full flow is in our guide to buying gift cards.

Not live yet: anonymous agents with no owner. That path needs the card provider's written approval first, because a named buyer is required. The per-card ceiling is also deliberately low while the forwarding contract awaits an outside review.

One honest note on price. The card provider's quote includes its own spread, and that spread is a larger share of a small card. An agent should compare the total with the face value before it pays. The mechanics of x402 itself are covered in our x402 explainer.