Intro
The story starts in 1999, when HTTP/1.1 defined a status code called 402 Payment Required, meaning this resource requires payment to access. But at the time nobody knew how to conveniently and securely collect money on the internet, so this status code sank into the vast ocean, and stayed down there for more than twenty years
How x402 Works
The Flow
- An agent/AI crawler sends you a request
- The server returns 402, along with a JSON stating the price, the accepted asset type (USDT, say), the settlement network (Tron, say), and the receiving address
- If the client is willing to pay, it signs according to the terms the server has quoted
- The client puts the signature into a dedicated HTTP header and resends the request
- The server verifies the signature and passes it to the settlement party; if everything checks out, it returns 200 and lets it through
How Do You Prove I Paid?
Anyone who understands modern cryptography a little has probably already figured it out: once the payload is signed, nobody can tamper with it — tamper with it and it becomes invalid. Second, the signature itself is the proof: if you can produce a signature, that shows you control this wallet address, and since this signature only corresponds to this one payment, it can’t be forged
What Does the Settlement Party Do?
The server doesn’t need to understand blockchain or nodes; it just outsources to a facilitator, and that party takes care of signature verification / payment validity / whether it’s a replay or other attack / broadcasting on-chain to complete settlement, all in one go. Currently Coinbase Developer Platform operates the main facilitator, doing fee-free USDC settlement on base chain, which has led many people to question the decentralized credentials of x402, since it depends on a single centralized service provider. I personally am pragmatically oriented and don’t much care about decentralized or not — black cat or white cat, as long as it catches mice it’s a good cat
Why x402 Got Dug Up
This thing was defined back in 1999, but before web3 finance matured, traditional payment rails were all too heavy; web3 has now solved exactly this long-standing problem. Second, AI has become the main visitor. The traditional internet was designed for people: when people hit paid content they subscribe and pay themselves. But now, much of the time it’s AI looking at your site, and it won’t subscribe or look at ads — and AI requests are already a million times the human volume. Where there’s demand there’s a market: people need a way to meter AI, so Coinbase and Cloudflare hit it off and jointly pushed for the founding of the x402 Foundation, opening up and standardizing 402
timeline
- 2025/07/01 Cloudflare launched
Pay Per Crawlin private beta, letting content owners charge AI crawlers via 402. At the time there were three policies: fully open / set a price / block everything outright - 2025/09 The two giants Coinbase & Cloudflare hit it off and began pushing for the founding of the x402 Foundation
- Late October 2025 The x402 Foundation was formally announced
- 2026/7/1 Very recently, Cloudflare released a monetization gateway, expanding the charging scope from crawlers only to any caller, and changing per-request charging to charging based on whether the content is cited (because crawling is a terrible metric: a page might be crawled once but cited thousands of times, or crawled countless times but never used by anyone
Case Studies
Cloudflare data shows that in June 2025, OpenAI’s referral ratio was 1700:1, and Anthropic’s was 73000:1. Also according to Cloudflare, only 37% of the top ten thousand sites have correctly configured robots.txt — quite shocking
On DeveloperIO, a developer connected x402 to his own site (a DJ gig database with ten thousand entries). OpenAI’s crawler did indeed pay through x402, but at the time it was the only crawler that supported it; what followed was a full paywall that blew up his SEO, and in the end he had to switch to partially free, partially paid
Controversy
Recently, looking at HackerNet, there are basically two typical controversies
- Some think this approach will discourage users’ willingness to pay
- Some think Cloudflare will bring privacy problems, and wonder whether it can become the new AdSense or will turn into a failed payment experiment
Conclusion
My view is that, for small and mid-sized site owners, there’s a very high probability the AI companies simply give up crawling. The marginal value of a single piece of content is too low, and the internet is oversupplied with homogenized tutorials and blogs; if you don’t let them crawl, they just switch to another source. There’s no exclusive, hard-to-replicate technical moat in this kind of thing — unless you’re the industry leader with an exclusive data source, in which case there might be some room to negotiate
Cloudflare changing to citation-based payment is also an admission of this: only when you genuinely create value do you deserve to negotiate terms, and what determines bargaining power is whether the content itself is replaceable. That DJ database got OpenAI to pay precisely because it’s a first-hand, exclusive data source for the whole web; swap in an ordinary personal blog like ours, and there’s a good chance you don’t even reach the threshold of being worth paying for (lol
Essentially, it gives content providers a bargaining chip to negotiate with, rather than a direct source of monetization
