All posts
· 11 min read ·

Identity verification has to be cheaper than the average x402 payment. It isn't yet.

x402 has processed 165 million payments averaging about $0.30 each. Per-transaction identity verification has to fit under that ceiling, which it doesn't, and which the May 2026 cloud-provider adoptions make urgent.

The headline number from x402, Coinbase's HTTP-native agent payment protocol, crossed a notable milestone earlier this spring: 165 million transactions processed across the protocol's first ten months, by roughly 69,000 active AI agents. The headline number is wrong about what matters. The interesting number is the average per-transaction value, which works out to approximately $0.30. That figure sets a hard economic ceiling on something the agent web has spent the past year deferring: per-transaction identity verification.

Two cloud-scale adoptions in the past two weeks make the timing of this argument less academic. AWS launched Amazon Bedrock AgentCore Payments in preview on May 7, 2026, with x402 as the underlying rail. The use cases they list are explicitly micropayment-shaped: premium market data access, sanctions screening queries, credit bureau lookups, real-time analytics snapshots, one-time access to news articles. Five days later, Circle launched Circle Agent Stack on May 12 — and its most architecturally aggressive component, Nanopayments, supports gas-free USDC transfers as small as $0.000001. One-millionth of a dollar. Settlement at machine speed.

The shape of the agent payment economy is becoming visible in the data, and the shape is not e-commerce.

What the volume actually looks like

The traffic profile across x402's first ten months, as reported by Coinbase and corroborated by third-party trackers:

Metric Value Source
Total transactions 165 million Coinbase / public tracker, as of April 21, 2026
Total volume ~$50 million Same
Active AI agents ~69,000 Same
Average transaction value ~$0.30 Derived ($50M / 165M)
Average transactions per active agent ~2,400 Derived (165M / 69k)
Settlement time <2 seconds Coinbase docs
Per-transaction cost ~$0.0001 Coinbase docs

The numbers describe machine-to-machine API access. They do not describe a human-facing commerce economy of the kind the McKinsey projection AWS cites ($3–5 trillion in agentic commerce by 2030) imagines. The two markets can coexist, and probably will, but the data we have right now is of agents making thousands of dust payments each, for things that look much more like API calls than purchases.

That distinction matters because the operational shape of an economy priced at $0.30 per transaction is structurally unlike one priced at $30.

x402 average payment versus identity verification cost tiers Logarithmic horizontal bar chart on a base-10 scale from $0.0001 to $10. The average x402 payment is rendered as a pink dashed ceiling line at thirty cents. Four identity-verification mechanisms are plotted against it: a signature check at roughly one ten-thousandth of a dollar (under the ceiling), an OAuth roundtrip at roughly two cents (under the ceiling), a token-introspection round trip at roughly twelve cents (just under the ceiling), and a KYC lookup at roughly one dollar (above the ceiling). The visual makes the cost-fit problem legible at a glance. PER-OPERATION COST · LOG SCALE $0.30 ceiling

signature check $0.0001

OAuth roundtrip ~$0.02

token introspection ~$0.12

KYC lookup ~$1.00

$0.0001 $0.001 $0.01 $0.10 $1.00

FIGURES ILLUSTRATIVE · ORDER-OF-MAGNITUDE

Why $0.30 is an identity-cost ceiling

Per-transaction identity verification has a real per-call cost. A signature check, a KYC lookup, a token-introspection round trip, a revocation-list query: each of these takes computation, latency, and in some cases a third-party service that charges per request. In a payment flow where the average value moved is $30, those costs are amortizable against the transaction. In a payment flow where the average value is $0.30, they are not.

This is not a hypothetical. The OAuth 2.1 + PKCE flow that the MCP authorization spec adopted involves at minimum one token issuance, one token validation, and an authorization server round trip. Run at machine speed on micropayments, that work has to be done somewhere, and the somewhere cannot be in-band on every transaction without breaking the economics. Either it is cached at the agent level for a session, or it is delegated to a payment intermediary, or both.

Each of those choices has consequences:

  • Session-level caching means identity is bound to a session, not to each payment. If the agent is compromised mid-session, the bound identity travels with the compromise until the session expires.
  • Intermediary delegation means a third party (the facilitator, the cloud provider, the wallet) holds the authoritative identity and the payment rail trusts whatever it says. The trust then concentrates in that intermediary, which becomes a high-value target.
  • Bulk authorization means a single signed mandate authorizes many subsequent payments. AP2's mandate design points here, but the mandate-to-payment binding is the part still being worked out at the spec level.

x402 itself takes no position on which of these patterns wins. The x402 spec is deliberately a transport, and pushes identity to the layer above it. That's defensible, and it's the same pattern this stack has been showing all year: every layer of the agent payment stack delegates identity downward until the stack runs out of layers.

What this means for the registries that consume payment events

The Agenstry-relevant question is what an observer of the x402 data stream can verify. A facilitator can record that some key signed some payment for $0.30 to some endpoint. The downstream operational questions (was the signing agent who it claimed to be, is the receiving endpoint operated by who it claims, did the payment correspond to a service actually rendered) live in registries above and below the transport.

This is the same observation our earlier post made about the payments stack at the spec level. The April–May 2026 data adds two things to the picture:

  1. The cost ceiling is real and binding. When per-transaction identity work has to fit under $0.30 to make sense economically, "do per-transaction identity verification properly" is not a deferrable to-do. Either the work moves out of the transaction path, or identity stays an informal claim.
  2. The intermediaries are concentrating. AWS, Stripe, and Circle adopting x402 means a handful of facilitators will sit between most agent payments and the chain. Where identity caching lives, who controls it, and what its compromise model is — those become centralized questions even on a protocol that was designed to be transport-neutral.

A registry that publishes only that an agent's MCP card claims compliance is missing the layer where the actual money is moving. A registry that publishes probe results (does this server respond, does its card match its behavior, has any independent validator attested to it) gives a payment intermediary a signal it can use when deciding whether to honor a mandate. That is where the registry layer earns its place in this stack.

What we're watching

Three things, observable in the next two quarters:

  1. Whether the x402 v2 rollout or AP2's next mandate revision specify a per-agent identity caching pattern. A standardized session token bound to an agent identifier, with explicit revocation semantics, would close the gap that the $0.30 ceiling has made urgent.
  2. Whether Circle's Nanopayments at $0.000001 actually finds usage at that scale. A payment economy six orders of magnitude smaller than x402's current average will surface a different identity-cost problem again. Either the per-transaction security model evolves, or the nanopayment tier stays a marketing artifact.
  3. Whether AWS, Stripe, or Circle publish per-agent identity attestation alongside payment events. A facilitator that signs "this payment was made by this attested agent identity, verified against registry X" would be the practical convergence point between the payment stack and the registry stack. None of the May 2026 launches has done this yet.

The headline numbers on x402 read as "the agent economy is here." The per-transaction averages read as "the agent economy is paying for API calls, at fractions of a cent." Both are true. The interesting work over the next two quarters is on the layer that has to bind the second description to a verifiable identity, cheaply enough to fit under thirty cents per call.

Sources

← Back to blog Agenstry