x402 in production: pay.sh.

Section 1

What pay.sh is.

A hosted payment gateway plus an open-source CLI plus a facilitator catalog. The agent holds a Solana wallet; the gateway proxies requests to API providers; the agent pays per call in "stablecoins on Solana"; providers receive fiat. The CLI wraps existing tools — the docs example is pay --sandbox curl https://payment-debugger.vercel.app/mpp/quote/AAPL — and "detects MPP or x402 payment challenges, asks the local wallet to authorize signing, and retries the request with a payment proof."

The catalog spans four buckets — eCommerce (Rye, BigCommerce, Purch), Data and intelligence (Exa, Dune Analytics, Nansen, ATXP), Communications (AgentMail, StablePhone, StableEmail), and Solana Infrastructure (Helius, Alchemy, Quicknode, Allium, The Graph) — plus the Google Cloud APIs themselves: Gemini Inference, BigQuery, BigTable, Cloud Run, Vertex AI Model Garden, all shipped as x402-payable endpoints.

Section 2

The protocol posture.

pay.sh is built on x402 and MPP — what its docs call "machine-native payment protocols designed for agent-to-API commerce." The CLI "detects MPP or x402 payment challenges" and either is acceptable as a payment-required signal. The pay.sh docs explicitly endorse the open-standards posture: "we believe in supporting open rails that any developer, protocol, or facilitator can extend and build on."

This is the load-bearing line for x402's industry standing. Two days ago x402 was "Coinbase's pet protocol." Today it is the payment standard for a Solana-Foundation-and-Google-Cloud gateway with Gemini, Vertex AI, BigQuery, BigTable, and Cloud Run shipping behind it. The vocabulary — facilitator, challenge, payment proof, HTTP 402 — matches Coinbase's original x402 specification verbatim. Stable402 mirrors that vocabulary precisely. We ride the standards alignment rather than fork it.

The gateway is the layer that decides; the challenge type is interchangeable. pay.sh runs both x402 and MPP. The Coinbase CDP facilitator and Cloudflare's edge facilitator run x402 across EVM chains. x402 is the cross-chain HTTP-native standard; MPP is the Solana-native sibling. Both are open rails. Neither is a fork.

Section 3

What the launch names. What it leaves blank.

The single line in pay.sh's announcement that addresses compliance is this: "appropriate rate limits, quotas, and access controls so enterprise security and compliance are never compromised." That is the entire compliance posture in the public materials. The rest of the regulated counterparty layer is deliberately unspecified — by design, because it is not the gateway's job to specify it. But somebody has to.

None of this is a criticism of pay.sh. It is a payment gateway, not a regulated financial institution, and protocol-level openness is precisely why it works. But the regulated counterparty layer is where the largest stablecoin and agentic-payments incumbents — Circle, Paxos, Bridge, Catena Labs — actually live, and it is where Stable402's analysis sits. See the compliance gap map →

Section 4

Stable402's role next to pay.sh.

pay.sh is a load-bearing implementation. Stable402 is a reference. They are complementary, not competitive. Three concrete contributions Stable402 makes that pay.sh — by design — does not.

Section 5

Sources and further reading.