# AX-SYS-30: Let agents pay without a human checkout > Access and identity · advanced · AX-SYS-30 Accept payment inside the request itself, through a payment challenge the agent can answer or a scoped payment credential, instead of requiring a human to create an account and type a card into a checkout form. ## Why Paid APIs and services are usually sold through a human funnel: create an account, choose a plan, enter a card. Stripe's documentation names the problem: these flows require human input, which blocks agents from completing tasks autonomously. The emerging alternative is to make payment part of the protocol. With Stripe's machine payments, the server returns a payment challenge, the agent presents a valid payment credential, and Stripe settles the payment to the seller's balance. For cards, that credential is a Shared Payment Token, a scoped grant to use the customer's payment method that carries its own usage and expiration limits, so the user's spending bounds travel with it (see [AX-SYS-21](ax-sys-21-bound-autonomy-with-limits.mdx)). The x402 protocol, run by the x402 Foundation, does the same over plain HTTP: a request without payment gets `402 Payment Required` and a `PAYMENT-REQUIRED` header describing what to pay; the client retries with a `PAYMENT-SIGNATURE` header and receives the settlement in `PAYMENT-RESPONSE`. These protocols are young and still changing, and Stripe supports more than one, so treat them as examples rather than a settled standard. The design choice that holds is the same in all of them: the agent pays with a delegated, limited credential, never with the user's raw card details (see [AX-SYS-27](ax-sys-27-keep-user-secrets-out-of-agent-context.mdx)). ## Do Return a machine-readable payment challenge on paid endpoints and accept scoped, limited payment credentials. ## Don't Make a human signup and card form the only way to pay, or ask an agent to relay raw card numbers. ## Artifact ```http GET /premium-data HTTP/1.1 Host: api.example.com HTTP/1.1 402 Payment Required PAYMENT-REQUIRED: GET /premium-data HTTP/1.1 Host: api.example.com PAYMENT-SIGNATURE: HTTP/1.1 200 OK PAYMENT-RESPONSE: ``` Header names from the x402 v2 HTTP transport specification. ## Citations 1. [Stripe Docs: Machine payments](https://docs.stripe.com/payments/machine): Monetizing an API or service typically requires account creation, subscription selection, and payment entry; these flows require human input, which blocks agents from completing tasks autonomously. With machine payments, your server returns a payment challenge, the agent presents a valid payment credential, and Stripe settles the payment. Shared Payment Tokens are scoped grants that let an agent use a customer's payment method, and each SPT includes usage and expiration limits 2. [x402 Foundation: x402](https://www.x402.org/): If a request arrives without payment, the server responds with HTTP 402, prompting the client to pay and retry 3. [x402 specification v2: HTTP transport](https://github.com/x402-foundation/x402/blob/main/specs/transports-v2/http.md): The server signals payment is required with HTTP 402 and a PAYMENT-REQUIRED header; the client sends payment in a PAYMENT-SIGNATURE header; the server returns settlement results in a PAYMENT-RESPONSE header, each carrying base64-encoded JSON --- Source: Agent Experience Principles (axprinciples.com)