When your web browser asks a website for a page, the website sends back a hidden number as well as the page itself.
You have probably met 404, the number that means "not found".
There is another one, 402, which means "payment required", and it has sat in the rules of the web since the 1990s doing absolutely nothing.
Cloudflare has just switched it on.
Why now
Cloudflare is the company that sits in front of a large chunk of the web, filtering traffic and speeding pages up before they reach you.
Roughly a fifth of all websites pass through it, across more than 330 cities in over 100 countries, handling tens of millions of requests every second.
That scale is why this experiment matters more than a typical technology announcement.
The reason it is happening now is that the web's paying customers are starting to be machines.
Websites have historically made money in two ways: showing adverts to humans, or charging humans a subscription.
An AI agent, meaning a piece of software sent off to do a task on your behalf, does neither.
It arrives, grabs the sports scores or the price data or the article text, and leaves without ever seeing an advert.
By Cloudflare's own reckoning, AI crawlers now request content anywhere from 100 to 10,000 times for every human visitor.
That is a lot of expensive bandwidth being given away to a visitor the business model was never designed for.
How it works
The new system, called the Monetisation Gateway, is built on an open standard named x402, developed with the cryptocurrency exchange Coinbase.
A website owner writes a rule saying what costs what.
When a machine asks for that data, the site replies with a 402 and a price tag rather than the data.
The machine pays, asks again with proof of payment attached, and gets what it wanted.
The whole exchange happens inside the ordinary back-and-forth of a web request, with no checkout page, no account and no card details.
The point is that the payment is the credential.
Nobody has to be trusted, verified or signed up in advance, because the money itself is the proof of who is allowed in.
"Every API call requires an API key, which in turn requires a human, and adds unnecessary friction," said Kevin Leffew, a co-author of the standard, referring to the passwords that software currently needs to access other software.
Why cryptocurrency
The amounts involved are tiny, sometimes fractions of a penny.
Ordinary card payments cannot handle that, because the fee would dwarf the purchase.
So the payments settle in stablecoins, which are cryptocurrencies pegged to the dollar and designed not to swing in value.
Cloudflare's version starts with USDC and a standard called Open USD, which settle in under a second at negligible cost and cannot be reversed by a chargeback.
The standard itself does not care what money is used.
It can carry Bitcoin, and developers are already extending it.
Viktor Ihnatiuk, co-founder of UTEXO, said his team is working with the x402 community to add Bitcoin payments through a system called RGB, which handles transactions away from the main Bitcoin network to keep them fast and cheap.
Similar ideas have been tried before, including Lightning Labs' L402 standard, and community demonstrations in which agents bought football data from ESPN with Bitcoin in order to place automated bets.
A side effect worth noting
There is a defensive benefit buried in this.
One of the cheapest attacks on a website is simply to flood it with requests until it collapses under the cost of answering them.
If a request has to be paid for before the site does any expensive work, the attack stops being free.
Whether any of this catches on depends on something nobody yet knows, which is whether the AI companies building these agents are willing to hand over a wallet and let them spend.
