In this guide
What just happened?
Two things, six months apart, and both are verifiable. On March 17, 2026, World (the identity company Sam Altman co-founded, formerly Worldcoin) released AgentKit, which lets a verified person delegate proof of their humanity to an AI agent. On April 2, 2026, Coinbase handed its x402 payment protocol to the Linux Foundation as an open standard, with Visa, Mastercard, American Express, Stripe, Amazon Web Services, Google, Microsoft, Shopify, Cloudflare, Circle and the Solana Foundation named as founding participants.
Put together: a piece of software can now walk up to a website, get told “this costs 1 cent” or “prove a human sent you,” and satisfy either request in the same web call, with no card form and no login. That is new. Everything else in the videos is interpretation.
The web now has a standard way for agents to pay and a standard way for agents to prove a person is behind them. Neither is mandatory, neither replaces your card terminal, and neither matters to your business until agents start shopping on behalf of your customers. That part has already begun.
What is x402, in plain English?
x402 is a rulebook for one specific moment: a program asks a server for something, and the server answers “payment required.” The number 402 has been a reserved response code in the web’s HTTP specification since the early 1990s, set aside for exactly this and never standardized. x402 fills it in. The server replies with what it costs and where to pay, the client pays (today, usually a dollar-backed stablecoin on a public network), then repeats the request with proof of payment and gets the resource.
Why it matters commercially: it makes per-use pricing practical for machines. A search costs a cent, a document lookup a fraction of a cent, a data record a few thousandths. No accounts, no invoices, no monthly seats. Stripe now offers this as a product: a business returns a 402, the agent pays, and Stripe records it as an ordinary payment in the dashboard.
- Created by Coinbase in 2025; governed since April 2026 by the x402 Foundation under the Linux Foundation.
- Who signed on: Adyen, Amazon Web Services, American Express, Circle, Cloudflare, Fiserv, Google, KakaoPay, Mastercard, Microsoft, Polygon Labs, Shopify, Stripe, Visa, and others.
- What it is not: a new currency, a mandatory rail, or something a customer sees. It is plumbing between programs.
What is a human-backed agent?
AgentKit solves the other half of the problem. Payment tells a website an agent can pay; it does not tell the website whether the agent is one person’s assistant or one of ten thousand bots. World’s answer is to let a verified human sign a delegation: “this agent acts for a unique, real person.” The agent carries that proof, and a site that supports x402 can ask for payment, proof of human, or both, in the same step.
World says it has verified nearly 18 million people through its iris-scanning Orbs, and AgentKit was built with Coinbase as an extension of x402. Since launch it has added integrations with Shopify, Vercel, Okta and Browserbase, which is a reasonable signal that mainstream commerce tooling intends to check for a human behind the bot.
Payments are the “how” of agent commerce. Identity is the “who.” Both now have a standard, and both are optional until your customers’ agents start asking.
What do the viral videos get right, and wrong?
The clips racking up hundreds of thousands of views frame this as end-times prophecy. Here is a fair scorecard.
Right: the dates, the company names, the founding coalition, the 1991 reservation of HTTP 402, and the fact that World’s eye-scan program has been suspended or restricted in several countries over privacy concerns (Kenya, Spain, Portugal, and others have taken action at various points).
Wrong or stretched:
- “No human approval per transaction.” The person sets what the agent may do and how much it may spend. Autonomy inside a budget is not the same as no oversight; it is how a corporate card works.
- “This is what the iris scans were secretly for.” Proof-of-human for agents is one use of an identity network that has been publicly pitched for sign-ins, bot filtering and payouts since 2023.
- “Everyone signed in one day.” They expressed intent to join a foundation. Standards bodies are how large companies avoid one vendor owning a rail, not evidence of coordination beyond that.
- “You will not be able to buy or sell without it.” Nothing here touches how a person pays. It is a way for software to pay software. Cash, cards and bank transfers are untouched.
We are not here to argue theology. We are here to tell you what the code does, because that is what will decide whether your business shows up when an agent goes shopping.
What changes for a local business?
The practical shift is that your next customer may be represented by software. A person tells their assistant “find me a lip filler appointment this week under $600, somewhere with real reviews,” and the assistant does the research, compares three clinics and books one. Cloudflare reported in 2026 that fewer than half of all web page requests now come from a human. Payment and identity standards remove the last two frictions that kept those agents from finishing a transaction.
For a clinic, salon, dental office or coaching practice, three things now matter that did not two years ago:
- Readable. Your hours, prices, services, location and policies have to be published in a form a program can parse, not buried in an image or a PDF. Sites that block AI crawlers are invisible to this traffic entirely.
- Bookable. There must be a path an agent can follow to hold or request an appointment, with a human confirming on your side. A phone number alone is not enough.
- Verifiable. Agents will prefer businesses whose facts agree across the web, whose reviews are real, and who can show a real operator stands behind the listing. The same standards that let an agent prove it is human-backed will be used to ask whether you are.
You do not need a crypto wallet, an eye scan, or a new payment processor. You do not need to accept x402 payments. You need to be the business an agent can read, trust and book. Do that and the payment rail is irrelevant to you; the customer pays you the way they always have.
What should you do this quarter?
In priority order, cheapest first:
- Let AI assistants in. Check that your site’s robots file does not block the major AI crawlers. Most agencies set this years ago and never revisited it.
- Publish your facts once, correctly. One structured business profile (schema markup plus a plain-text summary for assistants) with hours, services, prices where you can, and a booking link. Every directory listing should match it word for word.
- Give agents a booking path with a human in the loop. A request form or booking endpoint that creates a held appointment and pings a person to confirm. Never auto-confirm from an agent.
- Make your reviews and press citable. Real, recent reviews on Google plus a couple of earned mentions on sites assistants already read. This is what breaks ties.
- Test it. Ask ChatGPT, Gemini and Perplexity who they would book for your service in your city. If you are not named, find out what they are reading instead.
A free AI Assistant Readiness check runs the first, second and fifth items against any website in about thirty seconds, with no login.
How Rooster handles this for clients
Every Rooster build ships with an agent-ready storefront: the machine-readable business profile, the assistant-friendly text summary, structured data across the site, a human-confirmed booking path, and a weekly check of whether the major AI assistants name the client for their buyer questions. As the identity and payment standards mature, the storefront can request proof of a human behind an agent before it accepts a booking request, and it can accept per-use payment if a client ever wants to sell data or access to agents. None of that is extra; it is part of the AI Search Agent in the standard build.
We also use these rails ourselves. Our research runs buy small pieces of data from other services per request, which is why a full competitive scan of a client’s market costs us about a penny. We have been on the buying side of x402 since August 2026, which is how we know what the receiving side needs to look like.
A free AI Scan shows how Google and the major AI assistants describe your business right now, which competitors they name instead, and whether an agent could read and book you today. About 30 seconds, nothing to install.
Sources: World, “Now available: AgentKit” (Mar 17, 2026) · Linux Foundation press release (Apr 2, 2026) · Stripe, x402 payments documentation.
Frequently asked questions
Do I need to accept crypto or x402 payments for my business?
Is the x402 protocol real, and who backs it?
What is a human-backed AI agent?
What should a clinic or local business do about this now?
Andrew Smart is the founder of Rooster Agents, a done-for-you AI marketing agency for high-ticket, cash-pay clinics. He writes about getting clinics found on Google and AI assistants, and turning that visibility into booked consults — all built on your brand. One client per market. Just text Rudy.
Could an AI agent find and book your business today?
Run a free AI Scan to see whether ChatGPT, Gemini, Perplexity, and Google’s AI recommend your business — and exactly which competitors they name instead. About 30 seconds, nothing to install.
Get My Free AI Scan