Cloudflare issued wallets to AI agents: web includes HTTP 402

On August 4, 2026, Cloudflare provided AI agents with wallets. Not metaphorically — literally: an agent receives an account in stablecoins, and a site behind Cloudflare can respond with an HTTP 402 Payment Required code with a price tag instead of a page. The 402 code has been sitting in the HTTP specification for thirty years as "reserved for future use." The future has arrived, and it is directly changing the economics of web scraping.

What Exactly Was Announced

The announcement was made during Agents Week — a themed week by Cloudflare. On one day, two products were launched:

Cloudflare Wallets — a programmable wallet. There is an Account Wallet, which is held by the account owner: they deposit and withdraw funds. Then there are Virtual Wallets — these are issued to specific agents, access is granted via an API key, and limits are set by the owner. The guardrails are explicitly listed in the announcement: allowed budget (allowance), list of permitted recipients (allow-list), and maximum transaction size.
cloudflare.pay — an identification handle. The account receives a stable web address that acts as identification; identity can be delegated to specific agents so that the receiving party can see who authorized the request.

Matthew Prince, co-founder and CEO of Cloudflare, articulated the logic: when an agent knocks on your door, you need to know who sent them — the company gives agents a "face," a connection to the person or organization that owns it, and trust, accountability, and commerce can then be built on top of that.

An important detail that is often lost in retellings: right now, only the reservation of the handle is operational. Will Pepper, the product director, describes the rest in the future tense — storing stablecoins, purchasing services, and receiving funds will be "enabled" by the wallet. Full access, including deposit and withdrawal of funds and virtual wallets, is promised in the "coming months." This means it is a bid for infrastructure, not a functioning billing system today.

Under the Hood: x402 and the Revived 402 Code

Payments are made using the x402 protocol — an open standard named after that very status code. The scheme fits into regular HTTP, without redirecting to a payment page:

The client requests a paid resource.
Instead of content, the server returns 402 Payment Required and a small payload: the price, the accepted asset, and where to pay.
The client pays and repeats the request, attaching proof of payment.
The facilitator verifies the payment, and the server delivers the resource.

The protocol grew out of development at Coinbase and now lives under the x402 Foundation as part of the Linux Foundation. The composition of participants explains why this is not just another blockchain experiment: among the 25+ companies around the standard are Visa, Mastercard, American Express, Google, Shopify, and Stripe. Settlements are made in stablecoins (USDC), and Cloudflare claims sub-second settlement and the ability for sellers to receive funds directly in their wallets or convert them to fiat.

This is Not the First Step, But the Third

Wallets are the final element of a structure that Cloudflare has been assembling for over a year:

July 2025 — pay per crawl. The site owner sets a price for the zone; a crawler that does not declare its intention to pay receives a 402 with pricing instead of content. This feature is still in closed beta.
July 1, 2026 — Monetization Gateway. An expansion from crawlers to anyone: money can be charged for any resource behind Cloudflare — a web page, dataset, API, or MCP tool call. Payment verification occurs at the edge, not at the origin, so there is no need to build your own payment stack. A waiting list is open.
August 4, 2026 — Wallets and cloudflare.pay. The second party to the deal has emerged: the one who pays and their identity.

The announcement of the Monetization Gateway includes examples of pricing — these are worth looking at closely because they are the first public price benchmarks for machine access: a few cents for web search with payment per call; $0.001 base rate plus $0.01 per megabyte at the download endpoint; $0.99 for a successfully closed escalation to support — payment is only for results.

Why This is Happening: Bots Have Become the Majority

The economic backdrop is evident in Cloudflare Radar's own statistics. For the week ending August 10, 2026, bots accounted for 60.6% of requests to HTML content compared to 39.4% from humans. Just at the beginning of June 2026, the ratio was 57.5% to 42.5% — meaning machines have not just crossed the halfway mark, their share continues to grow.

For site owners, this creates a rupture in the model: traffic is increasing, but ad impressions and clicks are not. Hence the second lever we wrote about separately: starting September 15, 2026, Cloudflare will by default block training and agent crawlers on ad pages for new clients and new sites (search crawlers remain allowed, and the setting can be turned off). According to July measurements, the default block covers about 8.5% of the top web.

The connection makes sense: first close the door, then set up a cash register next to it.

What This Means for Scraping: The Web is Splitting in Two

A key consequence that needs to be stated clearly. Previously, there were two access states — "allowed" and "blocked." Now there are three, and the third is "pay."

But only traffic that has declared itself qualifies for this third state. To receive a meaningful 402 and pay, an agent must have an identity: a handle, signed requests, and a link to the owner. This is exactly the same line that Web Bot Auth with cryptographic signatures for bots is following — the web is shifting from the question "who are you by IP" to "prove cryptographically who you are."

And traffic that looks like a regular browser from an ordinary person simply does not enter the payment funnel. It goes to the same place it always has: into the anti-bot framework with fingerprinting, behavioral analysis, and IP reputation.

Thus, the fork of 2026 arises, and the choice must be made consciously:

The "declared agent" path. You gain an identity, pay via 402, and receive predictable, legally clean access without an arms race. The price is money for each request and full traceability: the receiving party sees exactly who sent you and can disable you specifically.
The "ordinary user" path. You operate as a human — from a residential or mobile IP, with a legitimate browser fingerprint, at a human pace. There is no paid barrier for you because you are not a bot in terms of this system. The price is the quality of infrastructure: residential proxies for mass coverage and mobile where maximum trust is needed.

The third path — "declare yourself as an agent and not pay" — is precisely what this construct closes off.

Calculate the Arithmetic Before Choosing

Micropayments sound harmless until you multiply them by volume. Let's take the published Cloudflare benchmark of "a few cents per call." Even at 2 cents, a million pages would cost around $20,000. At a base rate of $0.001, the picture changes: the same million requests would yield about $1,000 plus traffic charges. The range is an order of magnitude — and it entirely depends on the price set by the specific zone.

The practical conclusion: the price of machine access ceases to be a constant of infrastructure and becomes a variable set by each site individually. Planning a data collection budget "on average across the board" will no longer work — calculations will need to be made for each source, just as API purchases are calculated.

An important caveat: these are estimates based on published Cloudflare pricing examples, not rates. Real figures will emerge when the Monetization Gateway exits the waiting list, and Wallets move out of "reserve handle" mode.

What to Do Right Now

Check your sources for 402. Add separate handling for the 402 code in your parser monitoring — currently, most pipelines will lump it into the general "4xx error" category, and you won't notice when a source switches to a paid model.
Segment sources by access mode. Create a list: where you are already accessing via the official API, where as a browser, and where paid barriers are likely. Major media and datasets behind Cloudflare are the first candidates for paid access.
Don't rush to declare yourself an agent. Until functionality is launched, registering an identity only provides traceability without reciprocal benefit. Reserving a handle on cloudflare.pay is a cheap insurance for the future, nothing more.
Maintain infrastructure for the "human" path. Regardless of what the paid overlay is, the anti-bot framework will remain, and the quality of the IP pool remains a fundamental factor. If you work with platforms where a machine rate will never exist — social networks, marketplaces, ticketing — nothing formally changes for you.
Budget for "access payment" in 2027. Even if today none of your sources charge money, the direction has been set by the infrastructural layer through which a significant portion of the web passes.

Conclusion

Cloudflare has completed the missing link: machines now have both identification and a way to pay. This is not "the end of the free internet" — there is still no functioning billing for any of the three parts of the construct, and pay per crawl has been in closed beta for over a year. But the direction is set, and the standard is backed by Visa, Mastercard, Google, and Stripe, not enthusiasts.

The practical meaning for those collecting data is straightforward. The web is splitting into two frameworks: paid and recognizable — for declared agents, and the familiar human one — for everyone else, where browser fingerprint, behavior, and IP reputation determine access. Choosing a framework is now a strategic decision with a price tag, not a technical detail. It is better to make this decision before the first important source responds to you with a 402 code.