Cloudflare Put a 402 Paywall Behind Every Domain. The Rail Was Never the Hard Part.

On 2026-09-30 Cloudflare opened a closed beta of its Monetization Gateway. It lets a domain owner charge agents per request over HTTP 402, settled in USDC on Base, through Coinbase's x402 Facilitator. We have settled on exactly that rail since we launched. So the interesting question is not whether the rail works — it plainly does — but what is left to build on top of it.

What actually shipped, verified

People will summarize this launch in a hundred ways, so it is worth pinning the facts to the source rather than to the retellings:

• The interface is the status code. Cloudflare's own framing: there is "no redirect to a checkout page and no separate payment API to call."
• Settlement is USDC on Base, through Coinbase's x402 Facilitator.
• Closed beta, U.S.-based sellers and buyers only, with more geographies promised.
• Named early customers: Cloudflare AI Gateway (pay per inference), Ceramic.ai (pay per web search), Stocktwits (pay for stock signals), API2PDF (pay per API access).
• Their published API2PDF example carries the challenge in a payment-required response header.

We checked our own live challenge to compare. curl -D - https://minia2a.uk/x402/mime-type answers 402 with the payment requirements in both the JSON body and a payment-required header, and the accept entry is:

{"scheme":"exact","network":"eip155:8453",
 "asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
 "payTo":"0xAb62452b4b019bC4402BFfCca6C706d16d72A7Bf",
 "amount":"50000","maxTimeoutSeconds":120,
 "extra":{"name":"USD Coin","version":"2"}}

Same scheme (exact), same network (Base, eip155:8453), same asset (USDC), and the same EIP-712 extra (name/version) a facilitator needs to build the transfer authorisation. That is the sentence worth stating plainly: this is not a competing rail. A wallet that learned to pay a Cloudflare-metered endpoint is, mechanically, able to pay ours.

The half that is genuinely new: the buyer

Most x402 coverage is about sellers — who is allowed to charge. The more interesting half of this announcement is on the buy side: U.S. Cloudflare customers can pay per inference at request time by sending PAYMENT-METHOD: x402.

A pay-per-call economy has two cold starts, not one. Everyone notices the seller side — nobody lists an endpoint until there are buyers to call it. The buyer side is quieter and harder: an agent will not integrate a payment SDK it does not already carry. A header that a platform already terminates is a buyer cold-start being solved by somebody else, for free. That is good for the whole space, this catalog included.

Four jobs a gateway does not do

Here is the honest complement. A gateway monetizes one domain, on first contact. A marketplace has to do four other things, and none of them is the rail.

1. Cross-seller discovery

A gateway answers "how does this endpoint charge?" It cannot answer "which of 1,694 endpoints should I call for this task?" Discovery is a separate layer, and it is the layer that decides whether an agent finds any seller at all rather than the one domain it already knew.

2. First contact

A gateway charges on the first request; that is its job. An agent evaluating an unknown endpoint needs the opposite — a free first look. We give 5 free trial calls per signed wallet, one shared allowance across the catalog, no registration, so testing an endpoint costs a signature and not a payment.

And the footnote, because it is the same disease as the provenance problem below: most of the wallets in our own trial count are ours. Of 1,338 trial wallets in the last 7 days, 1,336 trace to our own address prefixes. The trial mechanism is real and it works; the trial demand number is mostly us proving it works. We would rather publish the split than a flattering total.

3. Accountability when the delivery is bad

A facilitator moves money. It does not adjudicate a 200 that returned garbage. Settlement and redress are different layers, and the second is where trust actually accumulates. We run a refund path: 57 refunds, 0.875 USDC, against 226 settled on-chain payments. Small numbers — but they exist, and they are the layer a pure gateway has no structural reason to build.

4. Provenance of the numbers

Volume in agent payments is easy to inflate. A seller buying from itself moves a headline and proves nothing; independent analysis of Base x402 traffic this week found the same shape at scale — most headline buyers funded by the sellers themselves. So we publish the split instead of the total: 226 settled on-chain payments / 6.227 USDC, 6 paying wallets in 7 days against 1,338 trial wallets. That gap is the honest state of the market, and it is more useful to a builder than a bigger, fuzzier number.

The threat, stated without spin

Cloudflare owns the edge, an agent-identity primitive, and now a wallet relationship. That is three of the four ingredients of a marketplace. What it does not have is a catalog, and today the gateway is a closed U.S. beta with no published fee.

If it opens up and bolts a directory on top, the rail becomes the marketplace and the discovery layer gets squeezed. Our bet is that breadth and trust are the durable layer and the rail is not: rails commoditize, and the thing that told you which endpoint to call, let you try it free, and refunded you when it lied does not. If we are wrong, this post is a useful record of when we were.

What we are watching

• Whether the beta leaves the U.S., and at what fee — an unpublished fee is the whole question for sellers doing the math.
• Whether a directory appears on top of the gateway. That is the actual competitive event, not the gateway itself.
• Whether the x402 spec's newer schemes — upto, batch-settlement, auth-capture — become how agents actually buy metered capacity, because a paywall that can charge "up to X" is a different product from one that charges a fixed amount per request.

We will keep the challenge in the open. If you are building a client against Cloudflare's gateway and want to point it at an endpoint in our catalog, it is the same object — a 402 with an exact accept on Base, in the body and in the header.