Cloudflare Monetization Gateway: Letting AI Agents Pay per Request

The HTTP status code 402 Payment Required has been in the HTTP spec since the 1990s, and almost nobody used it. It was marked as “reserved for future use”, and neither browsers nor servers ever did anything meaningful with it. Now it is becoming the foundation for how AI agents and online services might pay each other.

Cloudflare has built a new service on top of it called Monetization Gateway. It announced the product and opened a waitlist in July 2026, and on September 30 it launched a closed beta. It is a paywall that a domain owner puts in front of an API, an MCP tool, a dataset or a website, and an agent that wants the resource pays for every request.

Why agents should pay at all

Cloudflare’s argument is that for thirty years the web ran on a simple deal: content in exchange for human attention, which means ads or subscriptions. AI agents don’t look at ads and don’t sign up for subscriptions. According to Cloudflare, AI crawlers also fetch content far more often than they send visitors back.

With APIs the problem looks a bit different. To use a paid service today, you have to register, get an API key, enter a card, and only then does metered billing start. For a person that is an annoyance, but for an agent that is supposed to find and call a suitable tool on its own, it is often a dead end. Traditional payment rails also don’t work for fractions of a cent, because the fees would be larger than the amount itself.

Monetization Gateway flips this around. No prior relationship between buyer and seller is needed, and the payment itself acts as the access credential.

How x402 works

Under the hood is the open x402 protocol, which Cloudflare is developing with other companies through the x402 Foundation. The whole exchange happens within normal HTTP traffic and looks roughly like this:

1. The agent sends an ordinary request, for example GET /premium-data.
2. The gateway answers with 402 Payment Required and a PAYMENT-REQUIRED header containing the price, the asset and the wallet to pay.
3. The agent signs a payment authorization and repeats the same request, this time with a PAYMENT-SIGNATURE header.
4. Cloudflare checks that the authorization is valid and only then forwards the request to the origin.
5. The origin responds, the gateway settles the payment, and the agent gets what it asked for.

Verification happens at the edge of Cloudflare’s network, so the origin never has to deal with invalid or unpaid requests. The origin does receive a signed token in a PAYMENT-CONTEXT header, and Cloudflare strongly recommends validating it before serving the paid resource. Settlement runs through Coinbase’s x402 Facilitator, and payments are made in the USDC stablecoin on the Base blockchain.

What sellers configure

Setup is rule-based, like many other things in Cloudflare. The seller picks a domain, a receiving wallet, the URL to charge for and a price. Rules can be narrowed by headers, query parameters, user agent, country, cookies and other request attributes. Conditions based on the request body are Enterprise-only.

The audience setting is the interesting part. Either everyone who hits the URL pays, or only verified bots do. That means a site can let people through for free and charge only machines. On top of that there are two pricing models:

• Fixed: every request costs the same.
• Variable: the gateway authorizes a maximum amount and the origin reports what was actually consumed once the request is processed.

According to the documentation, the minimum price is $0.001 per request and the maximum is $100. What Cloudflare itself will charge for the service hasn’t been published anywhere yet.

Who is already using it

In the beta announcement, Cloudflare lists a few early deployments. Its own AI Gateway lets customers pay for inference per request. Ceramic.ai, a search API with an index of more than 40 billion pages, charges agents a fixed price per search with no API key. Stocktwits offers agents sentiment and trending data for stock tickers.

The most telling example, in my view, is API2PDF, a service that converts HTML and documents to PDF. It used to require users to register and add a credit card after the first month, and according to Cloudflare that caused more than half of prospects to drop off. Now it answers requests without an API key with a 402 and offers payment on the spot, with variable pricing based on actual usage.

Who it is for, for now

Here comes the big limitation: the closed beta is only open to sellers and buyers based in the United States. Under the eligibility rules, sellers need an account older than 60 days, a credit card on file with Cloudflare, and a zone proxied through Cloudflare for at least 30 days. Cloudflare promises support for more geographies but gives no date. Anyone outside the US can’t try it yet.

Cloudflare also says the gateway is mainly meant for resources where the request itself is the unit of use: APIs, tools and data. For content that is crawled once and then used many times, it points to a separate program called Pay Per Use. So for a regular blog or news site, Monetization Gateway isn’t the right way to earn money from AI crawlers.

My take

What makes the most sense to me is getting rid of sign-ups and API keys. If AI agents really are going to pick and call tools on their own, for instance through MCP, they need a way to pay for them without a human filling in forms on their behalf. Paying per request fits that kind of use much better than a monthly subscription.

There are open questions, though. Payments run on stablecoins and a blockchain, which will be a legal and accounting headache for many companies. The whole setup is tied to Cloudflare and to Coinbase as the settlement facilitator, even if x402 itself is an open protocol. And it is still a closed beta for a single market. Whether HTTP 402 actually becomes a normal part of the web will depend on how many agents are willing and able to pay.