How APX moves money.
An open, x402-compatible protocol, a real double-entry ledger, and a router that picks the right rail per transaction. Agents pay. Merchants get paid. You stay in control.
The agent hits a paywall
It calls a merchant API and gets back 402 Payment Required with x402-style headers describing the price.
The agent signs a payment
It signs a single canonical string with its Ed25519 key and posts it to APX. No card numbers, no secrets on the wire.
We check the rules and move money
Budget, per-tx cap, sanctions, anomalies, all checked atomically. If it passes, the ledger debits the agent and credits the merchant in one transaction.
The merchant verifies a receipt
The agent retries with a gateway-signed receipt. The merchant verifies the signature locally, no round trip, and serves the response.
# The agent signs this exact string with its Ed25519 key: agentpay.payment.v1|<agent_id>|<merchant_id>|<amount_cents>|USD|<resource>|<nonce> # APX verifies it, moves the money, and signs a receipt back: agentpay.receipt.v1|<receipt_id>|<agent_id>|<merchant_id>|<amount_cents>|USD|...|<expires_at>
One payment. The right rail.
APX quotes every available rail per transaction and picks the cheapest one that still settles fast. Swap rails without touching your code.
| Rail | Fee | Settles | Best for |
|---|---|---|---|
| Internal ledger float | 0% | instant | most micropayments |
| USDC on Base | ~0.05% | seconds | larger / on-chain settlement |
| Cards (Stripe) | 2.9% + 30¢ | instant | funding, auto-reload, fallback |
| Instant bank (AP2) | ~0% | ~days | large, fee-sensitive transfers |
| MPP (Stripe / Visa) | ~2% | seconds | agent-native card rail |
A passport every agent carries.
So a merchant can trust an agent it has never seen. Signed by the gateway, verifiable by anyone, no call back to us.
The agent’s public key and display name
The org behind it (KYB-able), so a stranger isn’t a stranger
Its mandate: total budget and per-transaction cap
A gateway Ed25519 signature anyone can verify
Both sides. Every rail. Neutral.
Others pick a side: identity for buyers, or metering for sellers. APX runs both sides and routes across rails, with governance as the default.
| Buyer-only (identity) | Seller-only (metering) | APX | |
|---|---|---|---|
| Gives agents a wallet | partial | no | yes |
| Lets merchants get paid | no | yes | yes |
| Routes across rails | no | x402 only | yes |
| Governance (caps, anomaly, audit) | some | some | core |
| One integration, both sides | no | no | yes |
Every payment is two balanced entries that sum to zero. Balances are always provable. Reconciliation runs against real money.
Receipts are Ed25519-signed, single-use, and expire in minutes. Merchants verify locally; nothing can be replayed.
Both parties are screened before any settlement. A kill switch can halt all real money movement in one flag.
Read the protocol. Run the demo.
It’s open and x402-compatible. The whole loop runs in the sandbox.