There is no single answer across all three protocols. AP2 assigns payment-credential sourcing to a Credential Provider and uses mandates to express authorization. ACP describes checkout data and delegated payment flows, with the merchant processing through its payment service provider (PSP). x402 asks a client to pay and retry an HTTP request; the wallet and key custody behind that payment depend on the implementation.
The key is to distinguish the underlying payment instrument from a delegated token, a signed authorization, and a wallet key. Those are different objects, and the protocol that moves one does not necessarily control the others.
As an Amazon Associate I earn from qualifying purchases.
What “holds the credential” can mean
A payment flow may involve several distinct items: the underlying card or other payment instrument, a token that permits a particular payment, an authorization record, or a cryptographic key used by a wallet. Saying an agent “has the credential” can blur who stores each item, who can use it, and who approves a transaction.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Custody: which provider or wallet stores the underlying instrument or key.
- Delegation: whether the agent receives a limited token or other permission rather than the underlying credential.
- Authorization: what payment the agent is allowed to make, and how that permission is checked.
- Processing: which merchant and payment provider submit or settle the payment.
AP2, ACP, and x402 address different parts of this chain, so their roles are not direct substitutes.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Who supplies or controls payment data in each protocol?
| Protocol | What its documented flow addresses | Credential or payment object in focus | What it does not establish on its own |
|---|---|---|---|
| AP2 | Authorization and verifiable evidence for agent payments | A Credential Provider is the source of payment credentials; the agent presents a mandate authorizing payment against a specific instrument. | The protocol role does not identify a particular company or consumer wallet as custodian. |
| ACP | Merchant checkout interaction and payment handling | Checkout payment data includes a token and provider; delegated flows can use a scoped token such as a Shared Payment Token. | A delegated token should not be treated as the underlying card or wallet credential. |
| x402 | Payment exchange attached to an HTTP request | A client responds to a payment challenge and retries the request; wallet-based payment is involved. | There is no universal wallet custodian specified by the protocol; key management and custody vary by implementation. |
How AP2 separates credentials from permission
In AP2, the Credential Provider is the source of payment credentials. The agent does not simply receive blanket authority to spend: a Payment Mandate authorizes a payment against a specific payment instrument and is shared with the Credential Provider, payment networks, and the merchant’s payment processor.
The checks are divided by role. The Credential Provider verifies that the agent is authorized to access a suitably scoped credential. The merchant checks the checkout, while the merchant’s payment processor checks that the credential is authorized for that checkout. AP2 links checkout and payment mandates or receipts to provide verifiable transaction evidence.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
That distinction matters: the mandate is evidence of authorization, not the payment credential itself. AP2 makes the authorization path explicit, but its role definitions do not say that the agent becomes the custodian of the underlying instrument.
Free tools Windows power users keep installed
One-click scans. No signup required.
How ACP handles checkout payment data
ACP centers the merchant checkout. Its checkout specification describes payment data that includes a payment token and provider, and the merchant processes the payment through its existing PSP. Its payment-handler RFC also describes delegated credential flows, including Shared Payment Tokens.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A delegated token is permission-bearing payment data, not necessarily the card number, wallet secret, or other underlying credential. The important custody question is therefore which component creates and safeguards the underlying instrument, and what limits the delegated token carries. ACP’s checkout interaction clarifies how payment data reaches merchant processing; it should not be read as assigning the merchant custody of every underlying credential.
How x402 makes payment part of an HTTP request
x402 uses the HTTP 402 response as a payment challenge. When a request arrives without payment, the server returns 402; the client pays and retries the request. The unit of interaction is the request rather than an AP2-style mandate structure.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The payment is wallet-based, but x402 does not prescribe one universal wallet custodian. Depending on the implementation, a wallet may be controlled by the user, an agent environment, or a service. The protocol-level challenge and retry pattern alone does not tell you who holds the wallet key or whether an agent has direct access to it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Can AP2, ACP, and x402 be used together?
They need not be mutually exclusive. AP2 documentation includes an autonomous x402 payment example, illustrating how AP2 authorization and evidence can be composed with x402’s request-level payment flow. ACP addresses a different surface: merchant checkout and payment handling.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
A useful way to reason about a combined system is to ask which layer answers each question: who authorizes the agent, how the merchant collects checkout payment data, and how a particular HTTP request is paid for. A protocol’s presence in one layer does not answer custody questions for the others.
Questions to ask when evaluating a real implementation
- What object does the agent receive? Identify whether it is the underlying instrument, a scoped token, a mandate, or access to a wallet key.
- Who can authorize spending? Check what verifies the agent’s permission and whether the permission is scoped to an instrument, checkout, or request.
- Where are secrets stored? Find the wallet or credential provider’s custody and key-management design; do not infer it from the protocol name.
- Who processes payment? Separate the merchant’s checkout role from its PSP’s payment-processing role.
- What evidence remains afterward? Determine whether the implementation records the checkout, authorization, payment result, or links among them.
- What happens on failure or retry? In an HTTP 402 flow, establish how the client handles a challenge, payment failure, and retry without assuming that an authorization mandate is present.
What the specifications do—and do not—tell you
The official documentation establishes design roles and sample integration surfaces, not market-wide adoption, transaction volumes, or comparative real-world security performance. Partner lists or the existence of open-source code are not evidence of broad deployment or equivalent custody protections.
Version details are also subject to change: the AP2 specification material identifies version 0.2, ACP checkout and payment-handler documentation is evolving, and the x402 site has surfaced a V2 announcement. Check the relevant protocol documentation for the version and integration details applicable to a deployment. The sources do not establish a single geographic deployment boundary or universal merchant availability.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
