The most accurate way to read Mastercard’s Agent Pay for Machines (AP4M) right now is not its marketing page. It is the status code you get back. This newsroom fetched the program’s own hosts this week: ap4m.build answers HTTP 401 with a Basic auth realm; mastercard.com’s product page and October press page answer HTTP 403. The documentation is behind a login wall, and the wall is no longer something reported from the outside – it is verified at the door.
Early access opened October 20, 2026 and was covered the following day at Cloudflare Connect. The package is the first versions of the buyer-side and seller-side APIs, a developer toolkit, a sandbox and developer documentation; a demonstration at the event showed an agent clearing nine payments under a single approved budget. The program itself launched on June 10 with more than 30 companies – Coinbase, Stripe, Adyen, Cloudflare, Ripple, Polygon Labs, Solana Foundation, OKX among them – and Mastercard has said agent permissions and credentials are initially recorded on Polygon, Solana and Base. Enrollment is by request only. The program is not commercially available. Every specification and term behind that wall rides as vendor-reported, because nothing behind it can be fetched.
The clock on commercial availability has no published date. In June, Mastercard committed to expanding access later that year; that window is nearly out, and no general-availability date, pricing, or approval criteria have appeared since. What has appeared is the gate itself. As our pilot-wall analysis set out, the constraint on these launches is not capability but who absorbs the loss when an agent buys wrong – and the request-only state is where that question gets answered, slowly, one admission at a time.
Who gets in is the part nobody outside the program can answer. There are no published standards for participation, no criteria for general access, and no public application URL – two search passes this week found none, and the program’s own hosts refuse anonymous requests entirely. This is the ground seven answers already mapped: in agentic commerce the chargeable surface is the authorization, and enrollment is that artifact for the network itself. Unlike open developer ecosystems, AP4M runs as a closed loop – who transacts is decided by who is admitted, and the criteria stay inside the room.
The demand side is louder than the gate. Raj Dhamodharan, Mastercard’s executive vice president of blockchain and digital asset products and partnerships, told CoinDesk in June: “There are already transactions happening. There are already many declines happening because there is no payment option available. That is a leading indicator in our view.” He framed the pitch as the same trust machine card networks have run for decades in the B2B world. The explainx guide, quoting Mastercard’s launch release, carries chief product officer Jorn Lambert’s line about creating the conditions for a “superbloom” of AI business models. Seven days in, the superbloom is still on the far side of a blank register.
This piece walks the enrollment-clock axis, which is distinct from the axes this beat has already covered: what the products cost, who authorizes the payment, and where the money clears. What would move this story is specific and checkable: published access criteria, a public application path, a named non-partner enrollee, commercial terms, or a firm general-availability date. Until one of those lands, the enrollment state is the whole available signal – request-only, seven days in, with the door’s own status code as the most reliable document in the program.