Cloudflare's Monetization Gateway turns a 401 into a 402

Cloudflare has opened a waitlist for the Monetization Gateway, a product it says will let customers put a price on any asset already sitting behind Cloudflare: web pages, datasets, APIs, or MCP tool calls. The payment check runs at the edge, and at launch settlement happens in stablecoins over x402.

x402 is an open HTTP protocol named for the 402 status code. The exchange is short. A client requests a resource that is gated. Instead of serving it, the server replies with 402 Payment Required and a small payload stating the price, the accepted asset, and where to pay. The client pays, then repeats the request with proof of payment attached. A facilitator verifies the proof, and the server returns the resource. There is no redirect to a checkout page and no separate payment API. Settlement is peer-to-peer, so funds land directly in the seller’s wallet. Cloudflare is building x402 with the x402 Foundation, a coalition it describes as more than 25 industry leaders.

Two properties make this work for machine traffic. Amounts can be fractions of a cent because the protocol adds almost no overhead, and the buyer needs no account with the seller because the payment itself is the credential. x402 is rail agnostic, but Cloudflare is starting with stablecoins, which it names as USDC and Open USD, and which it says settle in under a second with negligible fees and no chargebacks.

What Cloudflare adds on top is a rules engine. You write expressions in a dedicated product API, in the same style as other Cloudflare rules, to decide which traffic has to pay. The capabilities it has described so far:

• Charge per REST verb. For example, $0.01 on every GET or POST to /api/premium/*.
• Variable pricing. Image generation might charge any amount up to $2, depending on the compute used.
• Charge only unauthenticated callers. The Gateway intercepts a 401 Unauthorized returned by your origin and sends back a 402 Payment Required instead, with pricing and payment instructions.

That last capability is the interesting one for anyone running an access boundary. Normally a caller without a valid credential gets a 401 and stops there. The Gateway turns the missing credential into a payment prompt, with no account, no API key, and no prior relationship required. You still choose how much you want to know about the buyer. Cloudflare says you will be able to require agents to authenticate with Web Bot Auth and apply usage-based pricing against accounts they already hold, so a paid path and an authenticated path can run side by side.

For an operator, the practical change is where the work lives. Metering, the payment exchange, and settlement move off your origin onto Cloudflare’s network, which runs across 330+ cities, so the x402 handshake happens near the buyer. When a request matches a rule, payment is verified before the request reaches your origin. You keep the rules, the prices, and the revenue, without standing up a billing system or onboarding the buyer. Rules can be set in the dashboard or managed as code through the Cloudflare API and Terraform, so a paid endpoint becomes a line in your infrastructure config.

Sellers take payment in stablecoins and can either spend them or redeem them for fiat in a bank account. That is the one hard dependency to weigh. The money arrives as a stablecoin, and your accounting has to handle that step on the way to ordinary currency.

Cloudflare frames this as the step past Pay Per Crawl, the feature from last year’s Content Independence Day that let site owners charge AI crawlers for content. The Gateway extends the idea from crawlers and content to any caller and any resource. The longer pitch is an agent-first internet where agents carry wallets and buy datasets, API calls, tools, and compute without a person approving each payment, and where Cloudflare verifies the agent’s identity, applies the rule, and checks payment in a single request before the origin sees the call.

None of this is live yet. The announcement is written in the future tense throughout, and the only thing available today is the waitlist, which is open now for Cloudflare customers.