x402

An open HTTP payment protocol named after the 402 Payment Required status code, which sat unused in the HTTP spec for thirty years. The flow is four steps: a client requests a gated resource, gets a 402 carrying the price, pays, then repeats the request with proof of payment and receives the content. Settlement is peer-to-peer to the seller's wallet, in stablecoins, per cloudflare-monetization-gateway.

Why it exists now

Card rails cannot carry a tenth of a cent, and every previous attempt at web micropayments needed a human to approve each one. Both constraints ease when the buyer is a program: an agent can be given a budget and left to pay per call, and stablecoin transfers clear at amounts and speeds cards do not reach. Cloudflare's targets are sub-cent transactions with sub-second settlement.

What it is used for

• pay-per-crawl — the 402 a site returns to an AI crawler that has not paid.
• Metered resources — pages, datasets, API routes, MCP tool calls, priced per call through the Monetization Gateway.

The second matters to this spoke because it is the payment layer agentic-commerce assumes: if agents transact on a user's behalf, something has to move money between them without a checkout page.

The open question

A protocol for charging is not demand. x402 makes it possible to price a fetch; whether AI companies pay rather than route around priced content is a market question.

Written 2026-08-17: the only evidence so far is the 50-odd bilateral licensing deals counted in cloudflare-agentic-internet-report. Corrected 2026-08-30 — there is a great deal of evidence now, and reading it carefully makes the question sharper rather than answered.

The headline adoption is large. Coinbase reports 169 million payments across 590,000 buyers and 100,000 sellers in the protocol's first year, and about $50 million cumulative volume across roughly 69,000 active agents as of April 2026. Base settles ~85% of it. The x402 Foundation launched under the Linux Foundation in April 2026 with AWS, Cloudflare, Anthropic and Circle among 20+ members; Visa added support through its Trusted Agent Protocol and Stripe through its Agent Commerce Protocol.

And real commerce is a rounding error inside it. Analysis of the on-chain activity puts genuine-commerce volume at roughly $28,000 a day, with about half of all activity classified as gamified or testing rather than trade. Against 169 million payments, that is the number that matters: the protocol is unquestionably adopted and the thing it was built to price is barely being bought.

So the open question survives in a better form. It was "will anyone pay over a protocol rather than by hand?" It is now: the rails are built, the large parties have joined, agents are transacting in volume — and almost none of it is somebody buying content. That is a stronger statement of the same doubt, and it is the first time this spoke can put a number on the gap between a payment rail existing and demand for what it prices. The hand-negotiated licensing deals remain the only evidence of content actually being paid for at scale.

Related

pay-per-crawl · cloudflare-monetization-gateway · ai-content-monetization · agentic-commerce · agentic-commerce-protocol · cloudflare

Claim drain, 2026-09-06 — the claim holds, and the traffic moved under it

Re-checking "the hand-negotiated licensing deals remain the only evidence of content actually being paid for at scale" turned up no counter-evidence and two changes in the surroundings, both from trade reporting rather than from a primary, and recorded at that weight:

• x402 settlement volume is reported down about 93% year-to-date in 2026, read as the late-2025 surge having been testing rather than demand — while still above where it stood a year earlier.
• Cloudflare changed what it charges for. Pay Per Crawl priced a fetch; the model shifted toward paying publishers when their content appears in an AI-generated answer, on the reasoning that a crawler may pull an enormous number of pages and use very few.

The second is the more interesting one for this page: it concedes that per-fetch pricing named the wrong event, which is a different failure from the one the page has been tracking (that nobody pays at all).