Coinbase adds x402_url for agent USDC payments on Base

Coinbase Business Checkouts now return an x402_url that an AI agent or x402 client can call to authorize gasless USDC payments on the Base network. A successful checkout that reaches the COMPLETED status indicates that Coinbase has captured and settled the payment and provides an on-chain transaction hash as confirmation.

Merchants create a checkout by POSTing to the Coinbase Business Checkouts API with an amount and currency set to USDC. The create response includes a hosted payment URL for human users and an agent-facing x402_url for programmatic payments. Agents submit a POST to the x402_url to request authorization. A 200-level response from that POST indicates the payment was authorized, but merchants must wait for the checkout record to reach COMPLETED before treating funds as settled.

Checkout status normally progresses from ACTIVE to PROCESSING and then to COMPLETED. PROCESSING begins when Coinbase receives a valid authorization from an agent. COMPLETED means Coinbase has performed the server-side capture and can supply the on-chain capture transaction hash. Terminal unpaid states for a checkout are FAILED, EXPIRED and DEACTIVATED. A 402 response during payment typically leaves the checkout in ACTIVE status so an agent can retry; if the checkout becomes FAILED, merchants must create a new checkout ID for further attempts.

The x402_url payment path supports an EIP-3009-style authorize-then-capture flow on Base and is available only for Base network checkouts. Sellers must have a Coinbase Business account and the necessary CDP API keys and wallet secrets to use this flow. The agent path completes capture server-side, so merchants need not implement on-chain capture logic themselves.

Testing in the sandbox is limited because sandbox checkouts currently do not return an x402_url. Coinbase documentation recommends creating a small live checkout for agent testing and funding only the amount intended for tests. Integrations can use spend controls to cap per-payment amounts; Coinbase examples show a cap equivalent to 5 USDC per payment as a sample limit.

Merchants should store the x402_url together with the checkout ID when recording transactions, because list endpoints do not return the agent URL and the create response is the reliable source for that value. To confirm settlement, merchants can poll the checkout endpoint until the status is terminal or subscribe to Coinbase checkout webhooks for near-real-time updates. Webhooks are recommended when many agents will pay in parallel; polling can be sufficient for low-volume flows.

Refunds can be issued for COMPLETED or PARTIALLY_REFUNDED checkouts, in full or partially up to the remaining captured amount. Refunds are processed asynchronously; merchants should poll refund status or check the refundedAmount field until the refund is reported as REFUNDED or PARTIALLY_REFUNDED. Operational procedures for refunds should be kept separate from retry logic for unpaid checkouts.

Security guidance in the documentation advises storing CDP secrets and wallet keys in server-side secret managers and applying spend caps to any client-facing signing wrapper. Operators are advised not to expose an uncapped agent client to a public mainnet x402_url. The x402_url should be treated as an authorization endpoint rather than a settlement receipt, and merchant systems should only act on funds after the checkout reaches COMPLETED and the capture transaction is available.