← All resources

Agentic Payment Protocols: 402, Pay Per Crawl, and x402

Reference · updated 2026-08-19 · Markdown variant

Implementor's comparison of the three live mechanisms for agent-to-server content payment: self-hosted HTTP 402 gates, Cloudflare Pay Per Crawl, and the x402 open standard — plus how RSL fits as the licensing layer, not the settlement layer.

As agent traffic overtakes human traffic on the web (Cloudflare reported automated systems drove 57.5% of HTTP requests vs 42.5% human in mid-2026 — the first such crossover it has recorded), programmatic payment gates are becoming standard infrastructure. Three distinct mechanisms have emerged for gating content/resource access. ChangeGamer operates the first one in production; the others are ecosystem context every agent builder needs. A separate class of agent-purchase-authorization standards (ACP, AP2) that covers conventional fiat purchasing on a user's behalf is addressed later in this page.

Key facts

• Automated traffic reportedly now exceeds human traffic on the web, per Cloudflare's mid-2026 figure — a crossover that is pushing programmatic payment gates toward standard infrastructure.
• Three payment mechanisms are live today: a self-hosted HTTP 402 gate (the pattern ChangeGamer itself runs), Cloudflare Pay Per Crawl, and the open x402 protocol.
• Cloudflare Pay Per Crawl remained in closed/private beta as of July 2026, with Cloudflare acting as Merchant of Record over fiat settlement; on July 1, 2026 Cloudflare announced a broader Monetization Gateway (waitlist stage) that generalizes the same x402-based 402 pattern from crawler-only content to any Cloudflare-protected resource (APIs, datasets, MCP tools).
• On August 4, 2026 Cloudflare announced Cloudflare Wallets and cloudflare.pay: a human-held Account Wallet delegates capped spend to per-agent Virtual Wallets, plus an optional cloudflare.pay identity handle, integrating with x402-payable endpoints; only handle reservation is live so far, funding/spending/merchant support are "coming months."
• x402 settles on-chain in stablecoins (mainly USDC) across eleven CAIP-2 network families, and is now governed by the Linux Foundation's x402 Foundation, which grew from 22 founding members (April 2026) to 40 members — including new premier members Visa, Mastercard, and Ripple — at its operational launch on July 14, 2026.
• x402 adoption jumped roughly 10x once Apify put 20,000+ Actors on the protocol, and Coinbase has put cumulative on-chain settlement volume in the tens of millions of dollars across a triple-digit-million transaction count — though such published numbers move fast and should be independently re-verified.
• RSL is a licensing-declaration layer, not a settlement mechanism: it states permitted uses and compensation terms in a machine-readable document, while actual payment runs through a separate mechanism.
• ACP (Stripe/OpenAI) and AP2 (Google, governed by the FIDO Alliance) solve a different problem than the three content-payment mechanisms above — letting an agent check out with the account owner's money and consent, rather than gating content or resource access.

The three payment mechanisms

1. Self-hosted HTTP 402 gate (the ChangeGamer pattern)

The origin server returns 402 Payment Required with a JSON body that a machine can parse and act on. No CDN middleman. No crypto wallet required.

Flow:

1. Agent GET /resources/some-premium-slug
2. Server → 402 Payment Required + Content-Type: application/json

   {
     "error": "payment_required",
     "resource": "some-premium-slug",
     "price_usd": "0.05",
     "payment_url": "https://buy.stripe.com/...",
     "how_to_pay": "Buy an access key at payment_url, then retry with Authorization: Bearer <key>.",
     "terms": "https://changegamer.ai/resources/access-and-pricing.md",
     "license": "https://changegamer.ai/license.xml"
   }
   

3. Agent follows payment_url to purchase a key (Stripe checkout, EUR fiat).
4. Agent retries: GET /resources/some-premium-slug + Authorization: Bearer cg_<key>
5. Server validates key, returns 200 OK with resource body.

The 402 body also carries a partial preview of the gated resource in some implementations, so agents can decide whether the content is worth purchasing before committing.

Full contract documented at /resources/paying-for-access-402 and /resources/access-and-pricing.

2. Cloudflare Pay Per Crawl

A CDN-layer 402 marketplace: Cloudflare intercepts crawler requests on behalf of the origin and handles the pricing negotiation. Site owners set a per-crawl price in their Cloudflare dashboard (connected to Stripe); Cloudflare acts as Merchant of Record and remits monthly payouts.

Flow (reactive path):

1. Crawler GET /some-page (no payment intent header)
2. Cloudflare → 402 Payment Required with price information
3. Crawler retries with crawler-max-price header indicating budget
4. If price <= budget, Cloudflare passes through to origin, returns 200 OK + crawler-charged confirmation header

Crawlers can also use a proactive path: include crawler-max-price on the first request and receive a 200 immediately if the price is within budget.

A Discovery API (added December 2025) lets crawler operators programmatically list participating domains rather than discovering them via trial requests.

Settlement is fiat (Stripe). Cloudflare, not the site owner, handles the crawler billing relationship.

Status as of July 2026: closed/private beta. Invite-only. Request access via https://cloudflare.com/paypercrawl-signup or contact your Cloudflare account executive.

Monetization Gateway (announced July 1, 2026, waitlist stage): Cloudflare's next step beyond Pay Per Crawl — instead of billing only crawler content-fetches, site owners can write an edge rule charging any caller for any Cloudflare-protected resource (a web page, a dataset, an API, or an MCP tool call), enforced at the edge before the request reaches origin infrastructure. It settles over x402 (stablecoins, sub-second settlement) rather than Pay Per Crawl's Stripe-fiat rail — a sign Cloudflare is converging its own payment infrastructure on the same open protocol covered in §3 below, not building a parallel one. Currently early-access/waitlist, not GA.

Cloudflare Wallets and cloudflare.pay (announced August 4, 2026, primary-confirmed via direct fetch): the identity/spend layer that plugs into Monetization Gateway and x402-payable endpoints. A human-held Account Wallet (funded by bank transfer) delegates capped spend to per-agent Virtual Wallets, each with an allowance, a merchant allow-list, and a max transaction size. An optional cloudflare.pay handle (e.g. research.example.cloudflare.pay) lets a merchant see which account an agent acts for; declaring it is opt-in. As of this fetch, only handle reservation is live — funding, spending, and merchant support are "coming months," not yet GA.

3. x402 — open protocol for on-chain payment

x402 is an open standard that uses HTTP 402 to trigger on-chain stablecoin payment. Originated by Coinbase (open-sourced May 2025); governance moved to the x402 Foundation, co-founded by Coinbase and Cloudflare (announced September 2025) and formalized under the Linux Foundation in April 2026. The Linux Foundation x402 Foundation launched April 2, 2026 with 22 founding members including Google, Stripe, Visa, Mastercard, AWS, Circle, Shopify, and Solana Foundation, then held its operational launch on July 14, 2026 with 40 member companies — premier members now include Adyen, AWS, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Monad Foundation, MoonPay, Ripple, Shopify, Solana Foundation, Stellar Development Foundation, Stripe, and Visa (WebSearch-corroborated across 4+ independent outlets — the Linux Foundation and PR Newswire primary press releases both 403'd to direct WebFetch this session) — making it a broad cross-industry body, no longer just Coinbase and Cloudflare. Canonical repository: github.com/x402-foundation/x402 (the original coinbase/x402 is now a downstream fork).

Flow:

1. Client GET /resource
2. Server → 402 Payment Required + a JSON body carrying x402Version and an accepts array of PaymentRequirements objects (scheme, network, amount, recipient address, asset) — not a payment-requirements header
3. Client signs a transfer authorization (e.g. EIP-3009 for USDC on EVM chains; Permit2 is supported as a fallback for arbitrary ERC-20 tokens) locally — no gas spent yet
4. Client retries with an X-PAYMENT header (base64-encoded signed PaymentPayload)
5. Server (or a facilitator) broadcasts the transaction on-chain; facilitator does not hold funds
6. Server → 200 OK + X-PAYMENT-RESPONSE header (base64-encoded settlement receipt)

Supported networks: the spec now formally supports eleven network families via CAIP-2 identifiers — any EVM chain (eip155, e.g. Base, Ethereum, Arbitrum, Polygon, Optimism), Solana, TON, Algorand, Stellar, Aptos, Hedera, Keeta, NEAR, Concordium, and XRPL (the XRP Ledger). Primary stablecoin: USDC. The spec is network- and token-agnostic by design and may extend to fiat facilitators.

The public facilitator at x402.org is operated by Coinbase. Third-party facilitators can be used; the protocol does not mandate Coinbase infrastructure. Coinbase's hosted CDP facilitator settles USDC on Base with no facilitator fee (note: it authenticates with per-request signed JWTs from a CDP API key, not a static token).

Marketplace-scale adoption (June 2026): Apify, in partnership with Coinbase, put 20,000+ Apify Actors on x402 — roughly a 10x jump over the ~2,000 payable endpoints the ecosystem offered before. An agent calls an Actor, receives HTTP 402, settles in USDC on Base, and the Actor runs — no Apify account and no API key required. The integration uses both the exact scheme (fixed upfront price) and the newer upto scheme (authorize a maximum spend, get charged actual usage — Apify backs variable-cost runs with a deposit-and-refund mechanism). This made x402 the largest agent-payable tool marketplace to date and is the clearest signal yet that agent-held wallets are becoming standard operating equipment.

Discovery — the x402 Bazaar: Coinbase's developer platform (CDP) exposes a discovery layer that indexes x402-payable endpoints with semantic descriptions, payment metadata, and trust signals: GET …/v2/x402/discovery/resources (paginated catalog) plus a hybrid full-text + semantic …/discovery/search. Sellers do not register anywhere — the CDP facilitator auto-catalogs an endpoint the first time it settles a payment for it. For anyone selling to agents, the first real settlement doubles as the listing event.

Adoption has scaled into the hundreds of millions of transactions across Base and Solana, settled in USDC with zero protocol fees. Coinbase reported on the order of 165 million x402 transactions and approximately $50 million in cumulative settled volume by April 2026 (Coinbase's published figure, alongside ~69,000 active agents). Published figures change rapidly — treat any single snapshot as dated and check the x402 Foundation for current numbers.

RSL: the licensing layer (not the payment layer)

RSL (Really Simple Licensing) is an XML-based licensing standard that declares terms, not settlement. Published as an official industry standard (RSL 1.0) on December 10, 2025 by the RSL Collective (co-founded by RSS co-creator Eckart Walther and former Ask.com CEO Doug Leeds).

How it works:

• Publisher hosts a machine-readable license document (e.g. /license.xml).
• A License: directive in robots.txt points to that document.
• The license declares: permitted uses, attribution requirements, compensation model (free / subscription / pay-per-crawl / pay-per-inference / opt-out).
• RSL does not execute payment itself — it declares that payment is required and under what terms. Actual settlement is handled by whichever mechanism the publisher uses (Stripe, x402 on-chain, Cloudflare Pay Per Crawl, etc.).

ChangeGamer publishes its own RSL document at /license.xml, discoverable via the License: directive in robots.txt.

As of mid-2026, 1,500+ publishers have adopted RSL 1.0 — including the Associated Press, The Guardian, and Vox Media — and Cloudflare and Akamai provide infrastructure support.

Agent-authorized commerce: ACP and AP2 (a different layer)

The 402 / Pay Per Crawl / x402 mechanisms above gate content and resource access — they decide whether an agent can read a page or API response. ACP and AP2 solve a distinct but adjacent problem: how an agent is authorized to make a purchase on a user's behalf over conventional fiat rails. These are not content-payment protocols; they are agent-purchase- authorization protocols.

Stripe Agentic Commerce Protocol (ACP)

Open-source (Apache 2.0), co-developed by Stripe and OpenAI (announced September 2025). ACP standardizes agentic checkout using Shared Payment Tokens that are scoped to a specific seller and bounded by amount and time — preventing an agent from charging more than the user authorized. ACP powers OpenAI Instant Checkout inside ChatGPT and is designed to be adopted by any payment processor or merchant. Spec and reference implementation: https://docs.stripe.com/agentic-commerce/acp.

Google Agent Payments Protocol (AP2)

Announced by Google in September 2025 and donated to the FIDO Alliance for community governance. AP2 uses W3C Verifiable Credentials carrying three signed "Mandates" (Intent, Cart, Payment) that encode what the agent is authorized to buy, from whom, and with what payment method. It is payment-method agnostic — cards, bank transfers, and stablecoins are all in scope. The ecosystem includes 60+ partners including Mastercard, Visa, PayPal, and Coinbase. Current version: v0.2, released on GitHub April 28, 2026 alongside the FIDO Alliance donation, adding Human-Not-Present payments and a co-developed-with-Mastercard Verifiable Intent audit log; 60 contributing organizations were named at donation (WebSearch-corroborated across 5+ independent agreeing outlets — the FIDO Alliance and Google blog primary posts both 403'd to direct WebFetch this session). No stable 1.0 yet as of this check; consult https://agentpaymentsprotocol.eu/ for current status.

Comparison table

What agents must handle

• A 402 response with a JSON body (self-hosted gate or x402): parse payment_url (self-hosted gate) or the accepts array (x402), then retry with Authorization: Bearer <key> or an X-PAYMENT header respectively.
• A 402 response from Cloudflare Pay Per Crawl: read the price header; retry with crawler-max-price if within budget.
• An RSL License: directive: fetch /license.xml; parse permitted uses before deciding whether to fetch or cache content.
• Cache-Control: no-store on any 402 response — never cache it.

Verified sources

• Cloudflare Pay Per Crawl (private beta, July 2025): https://developers.cloudflare.com/changelog/2025-07-01-pay-per-crawl/
• Cloudflare Pay Per Crawl enhancements (December 2025): https://developers.cloudflare.com/changelog/2025-12-10-pay-per-crawl-enhancements/
• Cloudflare Pay Per Crawl — what it is: https://developers.cloudflare.com/ai-crawl-control/features/pay-per-crawl/what-is-pay-per-crawl/
• Cloudflare Pay Per Crawl signup: https://cloudflare.com/paypercrawl-signup
• Cloudflare x402 integration docs: https://developers.cloudflare.com/agents/agentic-payments/x402/
• Cloudflare Monetization Gateway announcement (July 1, 2026, fetched directly): https://blog.cloudflare.com/monetization-gateway/
• Cloudflare Wallets announcement (August 4, 2026, fetched directly): https://blog.cloudflare.com/wallets/
• Cloudflare Wallets press release (August 4, 2026, fetched directly): https://www.cloudflare.com/press/press-releases/2026/cloudflare-gives-ai-agents-an-identity-and-a-wallet/
• AP2 v0.2 / FIDO Alliance donation (April 28, 2026; WebSearch-corroborated, fidoalliance.org and blog.google both 403'd): https://fidoalliance.org/building-the-trust-layer-for-agentic-payments-with-ap2-and-verifiable-intent/ (see also https://www.pymnts.com/artificial-intelligence-2/2026/google-and-mastercard-contribute-agentic-commerce-standards-to-fido-alliance/)
• x402 Foundation operational launch, 40 members (July 14, 2026; WebSearch-corroborated, primary press releases 403'd): https://www.coindesk.com/business/2026/07/16/ai-payments-have-a-new-open-standards-body-its-aim-is-to-reinvent-the-internet
• x402 Foundation GitHub (canonical spec): https://github.com/x402-foundation/x402
• x402 network and token support docs (docs.x402.org and x402.org both EGRESS_BLOCKED to direct WebFetch this session): https://docs.x402.org/core-concepts/network-and-token-support
• x402 mechanisms directory — 11 network packages confirmed via direct fetch (August 19, 2026): evm, svm (Solana), avm (Algorand), tvm (TON), aptos, stellar, hedera, keeta, near, concordium, xrpl — https://github.com/x402-foundation/x402/tree/main/typescript/packages/mechanisms
• Coinbase x402 announcement (May 2025): https://www.coinbase.com/developer-platform/discover/launches/x402
• Coinbase + Cloudflare x402 Foundation announcement (September 2025): https://www.coinbase.com/blog/coinbase-and-cloudflare-will-launch-x402-foundation
• Linux Foundation x402 Foundation launch (April 2, 2026): https://www.linuxfoundation.org/press/linux-foundation-is-launching-the-x402-foundation-and-welcoming-the-contribution-of-the-x402-protocol
• Coinbase April 2026 x402 volume figures: https://cryptoadventure.com/coinbase-says-x402-has-processed-160m-agentic-payments/
• Apify x402 launch — 20,000+ Actors (June 2026): https://blog.apify.com/introducing-x402-agentic-payments/
• Apify x402 integration docs (exact/upto schemes): https://docs.apify.com/platform/integrations/x402
• x402 Bazaar discovery layer (CDP docs): https://docs.cdp.coinbase.com/x402/bazaar
• Coinbase x402 Bazaar launch post: https://www.coinbase.com/developer-platform/discover/launches/x402-bazaar
• RSL 1.0 official standard (December 2025): https://rslstandard.org/press/rsl-1-specification-2025
• RSL standard homepage: https://rslstandard.org/
• RSL 1,500-publisher milestone (mid-2026): https://mediacopilot.ai/rsl-licensing-standard-hits-1-0-gains-support-from-1500-publishers/
• Stripe ACP blog (September 2025): https://stripe.com/blog/developing-an-open-standard-for-agentic-commerce
• Stripe ACP specification docs: https://docs.stripe.com/agentic-commerce/acp
• Google AP2 homepage (FIDO Alliance): https://agentpaymentsprotocol.eu/
• AP2 landscape overview: https://www.openfort.io/blog/agentic-payments-landscape
• ChangeGamer 402 gate implementation detail: /resources/paying-for-access-402
• ChangeGamer access and pricing: /resources/access-and-pricing

Content freshness

This page tracks a fast-moving standards space — Pay Per Crawl's beta status, x402 transaction and settlement figures, RSL publisher counts, and ACP/AP2's version and governance milestones can all shift within weeks. Treat the material here as most reliable as of this page's updated date (2026-08-19); mechanisms, adoption numbers, and standardization status are all liable to have moved on by the time you read this. If you're reading this after roughly Q4 2026 (around October 2026), independently re-verify the specifics above rather than relying on this snapshot.

#402 #payments #x402 #pay-per-crawl #rsl #agents #monetization

Category: Reference