A Facebook reel on 8 November 2026 made its claim inside the first ten seconds: x402 is live, the web’s dormant payment code has been switched on, and the two companies behind it are Cloudflare and Coinbase. The reel runs 71 seconds. Its creator, David Ooi, ends by offering his notes on the AI-agent economy to anyone who comments the number 402 in the thread.
The mechanics in the video are correct. The gap is in what follows from them, because a standard being alive and a Malaysian website being able to charge for it are two different pieces of news, and only one of the two has happened.
Source: Facebook reel by David Ooi, opened at facebook.com/reel/1470360925034747, captured 8 November 2026. The video’s own graphics say “CLOUDFLARE” and “SWITCHED ON”; its caption reads, in Chinese, that the web specification has carried a “payment required” code for nearly 30 years. A reel is commentary, not a document, and nothing in this article rests on it.
What x402 is, in one request
A client asks a server for something. Instead of the page, the server answers with HTTP status 402 and a small machine-readable payload that states the price, the asset it will accept and the address to pay. The client signs a payment, sends the same request again with proof attached, and the resource is released. No account is created, no card is entered, no invoice is issued for the call.
That is the whole protocol, and it is deliberately small. Cloudflare’s engineers describe it this way: “The gateway uses the HTTP 402 Payment Required status code so buyers can offer payment for a resource over HTTP, inline with the request for the resource itself. This is an important distinction because there is no redirect to a checkout page and no separate payment API to call.”
The name is just the status code with an x in front. The standard is published at x402.org, which states that “x402 is an open, neutral standard for internet-native payments”, and that adding payment to an endpoint takes one line of middleware.
The thirty-year gap, in Cloudflare’s own words
HTTP 402 has been in the specification since 1997 and was almost never used. The clearest statement of that comes from Cloudflare’s April 2026 post introducing an agent-readiness score for websites, which puts the history and the revival in one paragraph.
Source: Cloudflare Blog, “Introducing the Agent Readiness score. Check to see if your site is agent-ready”, 17 April 2026, section headed Commerce, captured 8 November 2026 from https://blog.cloudflare.com/agent-readiness/
The paragraph itself:
“x402 solves this at the protocol level by reviving HTTP 402 Payment Required, a status code that has existed in the spec since 1997 but was never widely used. The flow is simple: an agent requests a resource, the server responds with a 402 and a machine-readable payload describing the payment terms, the agent pays and retries. Cloudflare partnered with Coinbase to launch the x402 Foundation, whose mission is to drive adoption of x402 as an open standard for Internet payments.”
Why it stayed unused for three decades is not mysterious. Payment rails were built for a buyer who accepts delay, transacts in amounts worth the fee, and can be identified by the seller. A form, a card number and a name. Software buying one API call for a fraction of a cent fits none of that, which is why the code sat in the spec while the industry used subscriptions and prepaid credits instead. Cloudflare makes the same argument in its September beta announcement: “Payments must match an agent’s consumption unit: per request, per search query, per token.”
Who governs it now
What changed the trajectory was not a payment company. It was governance. The Linux Foundation announced on 14 July 2026 that the x402 Foundation had become operational, with Coinbase’s contribution of the protocol complete, and published the member list, which is the part that makes the standard hard to ignore.
Source: https://x402.org/linux-foundation-announces-operational-launch-of-x402-foundation-to-standardize-internet-native-payments-for-ai-agents-and-applications/ — The Linux Foundation, “Linux Foundation Announces Operational Launch of x402 Foundation to Standardize Internet-Native Payments for AI Agents and Applications”, 14 July 2026, headline and summary, captured 8 November 2026
Forty organisations joined in the three months between the intent to launch in April and the operational launch in July. The premier tier alone reads: Adyen, Amazon Web Services, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Monad Foundation, MoonPay, Ripple, Shopify, Solana Foundation, Stellar Development Foundation, Stripe and Visa. General and associate tiers add a further twenty-three names, all published on the announcement itself.
Two details in that list carry more weight than the rest. The card networks are in it, which means the incumbent rails are hedging rather than fighting. And Cloudflare is in it as a founder alongside Coinbase, which is why a CDN company keeps appearing in a story about payments.
What a site owner can switch on today
Here the reel and the documentation part company. Cloudflare shipped a product that does exactly what the video implies, and it is not open to Malaysian businesses yet.
Source: Cloudflare Blog, “Monetization Gateway beta: charge AI agents for consumption with HTTP 402”, 30 September 2026, headline and opening paragraph, captured 8 November 2026 from https://blog.cloudflare.com/monetization-gateway-beta
Cloudflare’s Monetization Gateway lets a domain owner charge agents for access to a website, an API, an MCP tool or a dataset, priced per use, with the pricing rules written against any part of the request. Payment verification and settlement run through Coinbase’s x402 Facilitator, and the money settles on the Base network in a stablecoin pegged to the US dollar. The seller does not build a billing system.
Then the sentence that matters for this market: “The Monetization Gateway is available in closed beta to eligible U.S.-based sellers and buyers, with support for new geographies on the way.”
The question the reel invites is whether a Malaysian site owner can start collecting from agents this month. No. The protocol is open and free to implement, and any developer can put a 402 paywall on an endpoint without Cloudflare’s help. The productised version, the one that takes a few clicks and handles settlement, is a beta restricted by geography. Cloudflare also separates two jobs that the video runs together: charging for a resource where every request is a use, such as an API, and charging for a page that is crawled once and read a thousand times, which its Pay Per Use product handles through a network of verified buyers.
The agents are already here
What is not in beta is the traffic. OpenAI’s search crawler, Perplexity’s and Anthropic’s already read the sites Big Domain operates, and the volumes sit in server logs rather than in a vendor dashboard.
In a 17-hour window on 2 and 3 October 2026, the origin access log for one site Big Domain operates recorded 201 requests from OAI-SearchBot, of which 146 were served with a 200, plus 37 from PerplexityBot, nine from ClaudeBot, six from ChatGPT-User and two from GPTBot. ChatGPT’s search crawler re-read that site’s robots.txt seven times inside the same window, which is the detail that makes any policy change worth thinking through before it is made.
Whether those requests should be free is now a live commercial question rather than a philosophical one. A page an AI system cannot fetch cannot be quoted, and a page it must pay for may simply not be fetched, so the sensible split for most businesses is to keep the pages that win customers open and meter the ones where the content is the product. None of that requires x402. It requires a decision about which crawlers are welcome, and Cloudflare’s bot controls already let a site owner set that policy one crawler at a time.
What to check this week
None of these needs a new vendor or a budget line, and the first one is a dashboard setting rather than a project.
- Find out whether a 402 paywall would even reach your visitors. Cloudflare describes the Gateway as charging for “any resource behind Cloudflare’s network”, so a hostname that is not proxied through it is not in scope. Neither is a site behind a different provider.
- Read the robots.txt you are actually serving. Fetch it, do not assume it. If the site sits behind Cloudflare, the file being served may include a generated block that nobody on the team wrote.
- Separate the crawlers by job. Search crawlers bring citations and referral traffic; training crawlers do not. Blocking the first to punish the second is the most common and most expensive mistake in this area.
- Decide what is product and what is marketing. Price lists, product pages and booking forms are how a company gets found. Datasets, archives and internal tools are where a per-request price makes sense. Write the split down before an agent arrives.
- Watch the invoices you already pay. A team that runs agents of its own is on the buying side of this protocol now. Per-request billing from an AI tool looks different in a budget from a flat subscription, and it arrives as usage.
What to watch
Cloudflare’s geography line, since a Malaysia or Singapore region would be the trigger for most local sites to take pay-per-crawl seriously. Whether Pay Per Use moves out of beta, because that is the product aimed at content rather than APIs. And the first Malaysian case of a site charging agents for data, which will be a small story that says more than any launch post.
The reel is right about the interesting part. A code that sat unused for three decades is now load-bearing infrastructure, and it got there because two companies with very different motives agreed on a standard instead of a product. What the video compresses is the timeline. The standard is live. The billing is American, in beta, and per request. Malaysia’s turn is a thing to track, not a thing to do on Monday.
Last updated: 8 November 2026 — the Cloudflare posts of 17 April and 30 September 2026 and the x402 Foundation launch release of 14 July 2026 were read in full on this date, and the crawler figures were counted from our own origin log for 2–3 October 2026. No figure in this piece comes from a search summary.
Sources
- Cloudflare Blog, Introducing the Agent Readiness score. Check to see if your site is agent-ready, 17 April 2026, section “Commerce” (quote on HTTP 402 existing since 1997, the request-and-retry flow, and Cloudflare partnering with Coinbase to launch the x402 Foundation) — blog.cloudflare.com/agent-readiness
- x402.org / The Linux Foundation, Linux Foundation Announces Operational Launch of x402 Foundation to Standardize Internet-Native Payments for AI Agents and Applications, 14 July 2026 (operational launch, Coinbase’s completed protocol contribution, 40 members, premier member list, Jim Zemlin quote) — x402.org announcement
- Cloudflare Blog, Monetization Gateway beta: charge AI agents for consumption with HTTP 402, 30 September 2026 (closed beta, per-request pricing, settlement on the Base network in a dollar-pegged stablecoin through Coinbase’s x402 Facilitator, the U.S.-based availability line, Pay Per Use for content) — blog.cloudflare.com/monetization-gateway-beta
- x402.org, project description and one-line middleware example — x402.org
- Own measurement: origin access log for collamedia.com, window 2 October 2026 20:06 to 3 October 2026 13:32, counted by request line (OAI-SearchBot 201, PerplexityBot 37, ClaudeBot 9, ChatGPT-User 6, GPTBot 2, Bytespider 1). Hit counts taken with a case-insensitive line count, not a token count, because the standard user-agent string carries the bot name twice.
- Own captures, 8 November 2026: the David Ooi reel (facebook.com/reel/1470360925034747), the Cloudflare agent-readiness post, the x402 Foundation launch announcement and the Cloudflare Monetization Gateway post, each cropped to the passage quoted. Read-only.
BD Media is the editorial desk of Big Domain. This article explains a public payment standard and a vendor’s beta product as documented by their publishers on 17 April, 14 July and 30 September 2026. It reports one reel as commentary and rests no claim on it. It is not advice on payments, tax or licensing for any specific business.
