Table of Contents
Coinbase Business Checkouts return an x402_url that an AI agent or x402 client can pay programmatically. Paying it authorizes a gasless USDC payment on Base (EIP-3009); Coinbase captures and settles server-side with no hosted page or wallet pop-up required for the agent path.
Sellers do not need to build the paying-agent stack to go live. Create a checkout, expose x402_url, and treat checkout status COMPLETED as settlement truth. Primary source: Coinbase Business docs: Accept Agentic Payments with x402.
Roadmap: create a checkout, share x402_url, confirm settlement (poll or webhooks), optionally sanity-check with a capped test agent, then handle refunds on COMPLETED / PARTIALLY_REFUNDED.
Key Takeaways
- POST https://business.coinbase.com/api/v1/checkouts with amount and currency USDC returns hosted url plus x402_url.
- Paying x402_url authorizes (escrows); Coinbase captures server-side; treat COMPLETED as settlement truth.
- Status path ACTIVE → PROCESSING → COMPLETED; FAILED, EXPIRED, and DEACTIVATED are terminal unpaid.
- Base only; auth-capture scheme; CdpX402Client registers AuthCaptureEvmScheme by default.
- Sandbox checkouts do not return x402_url; use a live small amount and optional max 5 USDC (5_000_000n) spend cap.
What Coinbase Business Checkouts x402 is (and is not)
Checkouts use an authorize-then-capture flow. Paying x402_url authorizes (escrows) funds; Coinbase captures and settles server-side. A 200 on the payment POST means authorized, not settled.
Create responses include both a human hosted url and an agent x402_url. Only single-checkout responses carry x402_url (List Checkouts does not), so keep the create response or re-fetch by id.
This object is not Stripe x402 USDC accept, not a raw DIY x402 accept behind your own facilitator, and not the AgentKit buyer pay path. For protocol context see x402 protocol.
Who this is for (and who should skip it)
Use Business Checkouts when the firm already has a Coinbase Business account with a CDP API key and wants Base USDC agent payments without building capture logic.
Skip it when agents must pay on a non-Base network, when sandbox-only testing is required for x402_url, or when the stack already settles through Stripe x402 or a custom accept. Auth context: Coinbase Business authentication (JWT Bearer with rat#view scope on create).
How to accept agentic USDC with Coinbase Business Checkouts (2026)
1. Create a checkout (amount + USDC)
POST https://business.coinbase.com/api/v1/checkouts with a JWT Bearer signed by the CDP API key secret. Body example from Coinbase docs: amount "1.00", currency "USDC", plus an optional description.
The response includes id, status ACTIVE, network base, hosted url, and x402_url under api.cdp.coinbase.com payment-sessions authorizations. Humans can still open the hosted url on Base; agents use x402_url.
2. Expose x402_url to agents
Share x402_url with agents or your x402 client. The endpoint is a POST: the first call returns 402 Payment Required with requirements in the PAYMENT-REQUIRED header; the client retries with PAYMENT-SIGNATURE.
Checkouts advertise the EVM auth-capture scheme. CdpX402Client registers AuthCaptureEvmScheme by default. Clients that only know exact must register AuthCaptureEvmScheme from @x402/evm before paying.
3. Confirm settlement (poll or webhooks)
Poll GET /api/v1/checkouts/{id} until a terminal status. Expected path: ACTIVE → PROCESSING → COMPLETED. PROCESSING starts when Coinbase receives a successful authorization; COMPLETED means capture settled and transactionHash holds the on-chain capture.
Do not require observing PROCESSING; infrequent polling may skip it. Bad signature, wrong amount, or insufficient balance returns another 402 and leaves the checkout ACTIVE (safe to retry). FAILED is unpaid and not retryable on the same checkout. Also terminal unpaid: EXPIRED (expiresAt passed) and DEACTIVATED (you deactivated). Prefer webhooks for real-time status when available.
Failure handling: if status is FAILED, create a new checkout instead of retrying the same id. If the checkout is still ACTIVE after a 402, agents may retry with a fresh payment challenge.
4. Optional: sanity-check with a capped test agent
Not required to go live. Use only to pay your own x402_url once and confirm COMPLETED. Coinbase's sample uses a CDP-managed EVM account via fromCdpEvmAccount; customer agents need not use that pattern.
Prereqs from docs: CDP Secret API Key, Wallet Secret, USDC on Base, Node.js 22.18+. Packages include @coinbase/cdp-sdk, @x402/fetch, @x402/evm. Cap signing with applySpendControls example maxAmountPerPayment: { atomic: 5_000_000n } (5 USDC at 6 decimals), then wrapFetchWithPayment.
Sandbox checkouts do not currently return x402_url. Use a live checkout with a small amount and fund only what you intend to pay. Create the checkout after the payer is funded; unpaid checkouts expire at expiresAt (24 hours from creation if omitted). Buyer context: x402 buyer quickstart.
5. Refunds on COMPLETED / PARTIALLY_REFUNDED
A COMPLETED or PARTIALLY_REFUNDED checkout can be refunded fully or partially up to the remaining amount via Refund Checkout. Refunds are asynchronous; poll for refundedAmount and status REFUNDED or PARTIALLY_REFUNDED.
Keep refund runbooks separate from agent pay retries. For related wallet funding patterns see Circle Agent Wallet for USDC; for facilitator choice see how to choose an x402 facilitator.
Coinbase Business Checkouts vs other agentic USDC paths
| Path | Seller surface | Network / scheme | Settlement truth |
|---|---|---|---|
| Coinbase Business Checkouts | Create Checkout → x402_url | Base only; auth-capture (EIP-3009) | Checkout COMPLETED + capture tx hash |
| Stripe x402 | Stripe x402 accept integration | See Stripe / SCI Stripe how-to | Stripe payment status (separate product) |
| Raw x402 accept | Your server + facilitator | Network per facilitator config | Your facilitator / on-chain confirm |
| AgentKit buyer | Buyer pays existing x402 APIs | Buyer-side AgentKit client | Upstream seller settlement rules |
Pick Business Checkouts when Coinbase already holds capture and you want a hosted human url plus agent x402_url from one create call. Pick Stripe or raw accept when Coinbase Business is not the settlement operator. Pick AgentKit when you are the buyer, not the merchant.
Ops note: store x402_url with the checkout id in your ledger. If List Checkouts is used for reporting, re-fetch by id when you need the agent URL again.
Security note: wrapFetchWithPayment will sign whatever the server asks for unless spend controls bound it. Never point an uncapped client at a public x402_url on mainnet.
Product note: Business Checkouts keep humans on the hosted url and agents on x402_url from the same create call. That dual surface is the main reason operators pick this object over a buyer-only AgentKit path.
Integration tip: subscribe to checkout webhooks early so finance and agent runtimes share one COMPLETED signal. Polling alone works for low volume; webhooks scale cleaner when many agents pay in parallel.
Compliance tip: document that agent payments are Base USDC auth-capture under Coinbase Business Checkouts, not a custodial wallet transfer initiated by your firm. Keep CDP keys and Wallet Secrets in server secrets managers only.
Stablecoin Insider's take
Treat x402_url as an authorize endpoint, not a settle receipt. Wire webhooks or poll until COMPLETED before shipping goods or unlocking paid tools.
Need the broader agent accept map before you wire Business Checkouts?
FAQ
What is Coinbase Business Checkouts x402_url?
x402_url is the agent payment endpoint returned when you create a Coinbase Business Checkout for USDC. Paying it authorizes a gasless USDC payment on Base; Coinbase captures server-side.
Humans can still use the separate hosted url in a browser.
How do you create a checkout for agentic USDC?
POST https://business.coinbase.com/api/v1/checkouts with a JWT Bearer (rat#view scope), amount, and currency USDC.
The create response includes hosted url and x402_url; keep x402_url from create or re-fetch by checkout id.
When is an agentic checkout settled?
When checkout status reaches COMPLETED and transactionHash holds the on-chain capture. A 200 on the x402 payment POST means authorized (escrowed), not settled.
Expected path is ACTIVE → PROCESSING → COMPLETED.
Why do sandbox checkouts fail agent tests?
Sandbox checkouts do not currently return x402_url, so agentic payments cannot be tested there.
Coinbase docs say to use a live checkout with a small amount and fund only what you intend to pay.
What spend cap should a test agent use?
Coinbase's sample applies applySpendControls with maxAmountPerPayment atomic 5_000_000n (5 USDC at 6 decimals) before wrapFetchWithPayment.
Raise or lower the cap for your agent before pointing it at mainnet.
Can COMPLETED checkouts be refunded?
Yes. COMPLETED or PARTIALLY_REFUNDED checkouts can be refunded fully or partially up to the remaining amount via Refund Checkout.
Refunds are asynchronous; poll refundedAmount and status REFUNDED or PARTIALLY_REFUNDED.
Is Business Checkouts the same as AgentKit pay?
No. Business Checkouts are the seller create-and-settle product with x402_url. AgentKit is commonly the buyer client path for paying x402 APIs.
Stablecoin Insider covers AgentKit pay and Stripe x402 accept as separate how-tos.
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or tax advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation to buy or sell any financial instrument, and readers should conduct their own independent research or consult a qualified professional.
){kind=link}