Agents are browsing your site. You have three options.
AI agents now read documentation, call APIs, and pull data on their own behalf. For most businesses the response has been binary: block the bots, or serve them for free. There is a third option that is finally practical — charge them, per request, with no account and no invoice.
HTTP 402: the status code that waited
402 Payment Required has been part of HTTP since its early drafts. The current standard,
RFC 9110 (June 2022), still defines it in a single sentence: "The 402 (Payment Required)
status code is reserved for future use." For most of the web's history there was no agreed
convention for what a client should do on receiving one, so servers effectively never sent
it.
x402 revives it
x402 is a small convention layered on 402. The flow:
- An agent requests a protected endpoint.
- The server responds
402with machine-readable payment terms (amount, asset, where to pay, how to prove it). - The agent pays programmatically and retries the request with a payment proof header.
- The server verifies the proof and returns the resource.
Settlement is typically USDC on a low-fee network — Base and Solana are the chains the current spec supports — which makes sub-cent charges viable. The point is machine-to-machine micropayments, not checkout flows.
As of mid-2026, the open x402 spec (maintained at github.com/x402-foundation/x402) works
like this: the 402 response carries machine-readable payment requirements as JSON, and the
client retries with a signed-payment header (PAYMENT-SIGNATURE in the current spec; earlier
drafts called it X-PAYMENT). A facilitator — a service that verifies the payment and
settles it on-chain — is optional rather than required: the protocol is permissionless and
anyone can run one, but public fee-free facilitators (such as Coinbase's) make using one the
common path.
Where Cloudflare comes in
Cloudflare has pushed 402-based monetization at the edge so a publisher can meter and price automated access without running billing infrastructure. Two pieces are worth knowing as of August 2026:
- Pay Per Crawl, part of AI Crawl Control and launched in July 2025: a site owner sets a
price — minimum $0.001 per crawl — and Cloudflare bills AI crawlers per successful fetch,
returning
402with the price to crawlers that have not paid. - The Monetization Gateway, announced July 2026: a broader service built on x402 that lets you charge any caller — an API, a dataset, an MCP tool call — with settlement in stablecoin (USDC) that clears peer-to-peer in about a second.
Product names and pricing here are Cloudflare's and have moved quickly; check their current docs before building against them.
What an SMB actually exposes
You do not paywall your marketing site. You paywall the things an agent would pay for:
- Proprietary lookups (pricing, availability, inventory, coverage).
- Structured data you already sell as reports.
- Actions with real cost behind them (a quote, a booking hold, a document generation).
Price per call, meter it, and let agents pay their own way in.
The build
A working setup needs: 402 responses with correct terms, a metering and accounting layer, settlement handling and verification, rate limiting, and abuse controls. This is straightforward infrastructure work — it is mostly about doing the accounting correctly and not trusting the client.
Where TaskBreaker fits
We build the metered-endpoint layer, wire it to settlement, and hand you a dashboard of what agents are paying for. Book a call, or read how we built a bookkeeping agent.
Last verified against primary sources: 2026-08-30.