Cloudflare opened the closed beta of its Monetization Gateway on 30 September, letting domain owners charge AI agents for individual requests to APIs, MCP tools, websites and datasets. The payment does not happen in a checkout flow. It happens inside the HTTP request that asks for the resource.
Key takeaways
- Monetization Gateway entered closed beta on 30 September, covering APIs, MCP tools, sites and datasets, with payment authorisation carried inside the HTTP request via the x402 protocol.
- Transactions settle in USDC on the Base blockchain through Coinbase's x402 Facilitator, with Cloudflare handling verification, settlement, failures, retries and analytics.
- Four services already run it in production, including Cloudflare's own AI Gateway charging per token of inference and API2PDF pricing by compute and bandwidth consumed.
How paying inside a request works
The mechanism revives HTTP 402, the Payment Required status code that has sat largely unused in the specification for decades. A buyer's agent makes a request; if the seller has marked that request as paid, the gateway answers with payment instructions rather than the resource. The agent signs an authorisation, the payment settles, and the resource is released β no redirect to a hosted checkout page and no separate payments API to integrate against.
That matters for software that issues requests at machine volume. An agent calling a search index a thousand times cannot practically pause for a human to complete a card form, which is the structural reason agent commerce has so far been bolted onto human payment rails. Cloudflare is betting the transaction belongs in the protocol instead.
Settlement is explicitly on-chain. According to Cloudflare's announcement, payments clear in USDC, a dollar-pegged stablecoin, on the Base network, routed through Coinbase's x402 Facilitator. Cloudflare positions itself as the layer that absorbs the operational mess β verifying payments, settling them, handling failures and retries, and reporting analytics back to the seller.
Sellers get fine-grained pricing control
The seller-side controls are the most developed part of the launch. Operators define pricing rules that match on components of the request β URL, headers, query parameters β and pick a pricing scheme per rule. There is also an origin-controlled option in which the gateway asks the seller's own origin what a given request should cost, which allows prices that depend on work the gateway cannot see in advance.
The four production users illustrate the range. Cloudflare's AI Gateway charges per token of inference. Ceramic.ai uses a fixed price per search query. Stocktwits bills per request for individual market signals. API2PDF charges variably according to the compute and bandwidth a document generation consumes.
The buyer side is where the documentation goes quiet
What the published material does not describe is the symmetric control: spending limits for the party running the agent. Cloudflare's documentation details how a seller sets and varies prices, but does not specify caps, budgets or per-session ceilings that a buyer can impose on its own agents. In a model where prices can be computed at the origin per request, that asymmetry is the obvious place for costs to escape β an agent that retries aggressively against variable pricing has no documented brake inside the gateway itself.
Access is also tightly gated for now. Per Cloudflare's eligibility rules, buyers and sellers must both be based in the United States. Sellers need an account older than 60 days, a credit card on file, a verified email address, passing account-level security checks and acceptance of the service-specific terms. The zone being monetised must be proxied through Cloudflare, be more than 30 days old, and pass zone-level security checks.
Outlook
This is the commercial half of a strategy Cloudflare has been assembling in public, alongside efforts such as its push to rebuild the web's client layer for agents. Crawl-blocking told AI companies they could not take content for free; a per-request paywall tells them what taking it costs. The open questions are whether agent operators will accept stablecoin settlement as a dependency, and whether buyer-side budget controls arrive before the first expensive incident. Until the beta widens beyond US participants, neither will be answered at scale.
FAQ
What is x402 and how does it differ from a normal payment API?
x402 carries payment authorisation inside the HTTP request flow, using the HTTP 402 Payment Required response to return payment instructions instead of the resource. There is no redirect to a checkout page and no separate payment API call, so an automated client can settle and retrieve in one exchange.
How do payments actually settle?
In USDC on the Base blockchain, via Coinbase's x402 Facilitator. Cloudflare's gateway performs verification and settlement and handles failures, retries and analytics, so the seller does not operate crypto payment infrastructure directly.
Who can join the closed beta?
Buyers and sellers must be based in the United States. Sellers additionally need an account more than 60 days old, a credit card on file, a verified email address, and must pass Cloudflare account-level security checks. The monetised zone must be proxied through Cloudflare, be older than 30 days, and pass zone-level security checks.
