Selling to Agents: x402's USDC Rail vs ChatGPT Wallet

There are now two working ways to take money from an AI agent, and they have almost nothing in common. One is a tokenized card with a human approving every charge. The other is a dormant HTTP status code that settles in USDC, peer to peer, with no merchant account at all.

Both answer the question that blocked agentic commerce: how does software pay for something without being handed a credential a human would never hand over? They answer it in opposite directions, and the one you pick determines whether your buyer can be a person, a script, or either. Here is what each ships today.

The card rail: tokenized, with a human in the loop

According to OpenAI's announcement, the flow is deliberately plain. You add a card once, and that is the only time your real card details enter the picture. Before each purchase you review the items, the total and which card gets charged, then approve with a security check such as Face ID or a fingerprint. The payment network then issues a payment token — a substitute card number, security code and expiry date — and the agent and the business see that token, never your real card.

The design choice that matters most is the one that is easiest to skip past: there is a security check for every purchase, not a one-time permission you grant and forget. That makes this version an assistant that does the legwork, not an agent with a spending account.

OpenAI says it developed Wallet with American Express, Mastercard and Visa, and that it runs through OpenAI's "dots" agent platform. Three networks rather than one is why the tokenization can ride the rails your card already uses.

Who can actually use ChatGPT Wallet

Almost nobody, yet. Per the announcement, the rollout starts November 13, 2026, with ChatGPT Pro subscribers first, in the US, aged 18+, with eligible US-issued cards. No date for other plans, no date for other countries. Against a user base the write-up puts at 1.2 billion people using ChatGPT each week, that is a narrow slice.

One caveat worth stating plainly: the developer who compiled this breakdown notes he has not used Wallet hands-on, and that everything available is from OpenAI's announcement of November 13. Nobody outside the rollout has tested the dispute path, which is the part that decides whether a payment product works.

What merchants have to change

There is one instruction in OpenAI's Commerce Partner Playbook that will quietly break checkouts if ignored: configure your CDN and firewall to recognise signed requests via Web Bot Auth, and do not block agents. If your bot defences treat every agent request as a scraper, your customers' agents cannot check out with you at all.

That is a deliberate configuration change, not a default. The supporting cast named alongside it — fraud-prevention partners Forter, Riskified, Sardine and Signifyd, and payment providers Adyen, Checkout.com and Stripe — tells you this is aimed at established storefronts with existing risk tooling.

OpenAI also stresses that businesses keep the customer relationship: pricing, fulfilment, returns and customer service stay with the merchant.

x402: the status code that waited 31 years

The other rail starts from a different premise — that the buyer is not a person at all. HTTP 402 has been in the status code spec since 1995, defined as "Payment Required" and reserved for future use, and it went unused until the agent economy needed exactly what it describes: a machine-readable way to say this resource costs $1, pay here, then retry.

The loop is two round trips. A client hits your endpoint; your server responds with 402 and a PAYMENT-REQUIRED header, a base64-encoded object listing the price, the asset (USDC), the network and the seller's wallet address. The client pays that exact amount to that exact address — a plain USDC transfer, no deposit address, no escrow — signs the payment proof, and retries with an X-PAYMENT header. A facilitator service verifies the proof on-chain, settles, and the server returns the resource.

For a seller, the structural difference is the whole story: settlement goes peer-to-peer to any wallet you control. No merchant account, no KYC, no checkout page, no Stripe or PayPal binding, no API keys for buyers. The buyer needs a wallet, and that is it.

The x402 details that cost an afternoon

The developer who wired one up reports it took about twenty minutes, but flags four traps the quickstart skips:

• The v1 SDK is dead. The first wave of tutorials uses x402-express, now deprecated; the README points to the v2 suite (@x402/express, @x402/core, @x402/evm). The API shape changed enough that v1 snippets will not compile against v2.
• The official facilitator is testnet-only. It lists eip155:84532 (base-sepolia), solana devnet and a few others. For real USDC on Base mainnet you register at the Coinbase Developer Platform, which the write-up notes is free, and point the same client at the CDP facilitator — same code, different facilitator URL and network IDs.
• A minimal 402 body is not a bug. Testing with curl returns a bare payment-required error and looks broken. v2 puts the full requirements in the base64 PAYMENT-REQUIRED header, not the body. Decode the header before debugging anything.
• Peer conflicts. @x402/express drags in a paywall package that wants React 19; on a project pinned to React 18 you will need --legacy-peer-deps.

Which rail fits which seller

	ChatGPT Wallet	x402
Who pays	A person, approving each purchase	An agent, from its own budget
Instrument	Tokenized card on existing networks	USDC transfer, wallet to wallet
Seller setup	Existing card checkout, plus Web Bot Auth config	A wallet address and a middleware route
Availability now	US, Pro subscribers, 18+, eligible US cards	Testnet by default; mainnet via a CDP facilitator
Natural price point	Normal retail baskets	Sub-$5, single-shot deliverables

The split is cleaner than the overlap suggests. Wallet is for consumer purchases where a human is present and a chargeback matters. x402 is for the case the write-up describes as the natural customer: a script that needs one piece of data, mid-task, and can spend $1 of its own budget to get it — sub-$5 impulse tier, single-shot deliverables, no subscription dance.

If you sell physical goods, Wallet is the rail that will reach your customers, and the Web Bot Auth change is the one piece of work to schedule. If you sell data or a per-call capability, x402 is live today and needs no permission from anyone — while accepting that you are settling in USDC and handling your own compliance.

What to watch

The next step for Wallet, OpenAI says, is full delegation: letting the agent buy on its own within boundaries you set — spending limits, purchase categories or time periods — with pre-approval and what it calls "enhanced safeguards." No date has been given. Until it ships, Wallet and x402 are not really competitors; Wallet automates the shopping, and x402 automates the buying.

Two concrete things to check this week: whether your CDN is currently blocking signed agent requests, and whether anything you sell would work as a priced endpoint under $5.