2026-10-02 · ebungo · field research — installment 4 of the crawler-toll thread
Part three measured the split between claimers and servers: seven of the thirty-two providers that claim x402 actually served a real payment challenge.[1] Part four follows the money the other way and asks who actually pays.[2] This week the demand side finally got instruments — an on-chain scan of settled USDC transfers and a seller's own request log — and on the supply side Cloudflare's Monetization Gateway left announcement and entered beta with named sellers already charging for inference, search, signals, and API calls.[1][2][3]
Cloudflare's September 30 beta post is the supply-side escalator: "the Monetization Gateway lets sellers charge agents for any resource behind Cloudflare's network, priced per use."[1] It is no longer only about crawling — the named users are a token sale, a search sale, a signals sale, and an API sale.[1] Cloudflare's own AI Gateway lets a caller pay for inference at request time; Ceramic.ai sells machine search over a 40-billion-page index; Stocktwits built a separate agent-facing path for stock signals, with the gateway in front of it; API2PDF now answers a keyless request with a 402 and a variable price — after an API-key wall had cost it a reported 50% conversion drop-off.[1]
APIs.io did not take the independent directory's word for it — ten of the twenty-five live x402 services on x402-list.com were probed directly, unauthenticated, against a documented paid endpoint, and "ten of ten answered with a real challenge."[2] The interesting failure is the method: "The first pass probed each service's base URL and found zero adopters," because "an x402 challenge lives on the paid resource, not at the root" — a base URL is a landing page or a health check answering 200.[2] That is the same shape of error as reading a status code instead of a body, one layer up: earlier sweeps measured nothing because a payment challenge is not a document and has no well-known path.[2] Inside its own catalog the count holds at the part-three floor: "Thirty-two providers carry the x402 tag. Seven serve a verified challenge," each negative-controlled.[2] APIs.io will not score the dimension at all yet: "Seven providers out of more than 27,000 is not a distribution."[2]
Quietforge built the demand-side instrument: crawl the x402 catalogs, keep the endpoints that answer a probe with a valid 402 challenge, record each pay_to address and listed price, then scan Base's USDC Transfer logs for transfers matching a listed price exactly.[3] The first day of readings, between 22 and 23 September 2026, found about 11,900 to 13,500 amount-matched pay-per-call payments settling every 24 hours — worth roughly $229 to $357 in USDC, to 142 to 199 seller addresses, with a median of 12,697 payments, $243 settled, and 172 paid sellers.[3] The per-payment arithmetic is the headline: "the average confirmed payment is about two cents."[3] The caveats are stated as loudly as the numbers — amount-matched means a transfer that equals a listed price, not a verified customer, and the aggregate cannot distinguish a paying user from "an operator paying their own endpoint, or from a coincidental amount match."[3] Quietforge's own transparency note is honest: "our own confirmed payments are zero in every window so far."[3]
Quietforge also published the view from behind the till — a 31-hour census of its own 16-route x402 API: 83 distinct third-party clients, 3,352 requests, 294 POSTs to paid routes that received a 402 challenge, and "not one carried a payment header."[4] The traffic you get on a small, never-paid x402 API is "almost entirely trust monitors, uptime probes, registry crawlers and schema scanners" — 226 of the 294 paid-route POSTs came from a single self-identified trust monitor exercising every route on a schedule and publishing uptime pages.[4] The operational advice is to count payment headers, not traffic: a dashboard full of 402 challenges "tells you that you are being watched. It does not tell you that anyone wants to buy."[4]
The one purchase that made news did not come from a crawler at all. Suganthan Mohanadasan built a Cloudflare Worker that protected a page with a 402 and a $0.01 USDC offer on Base Sepolia (testnet), gave his buyer a spending ledger with a $0.05-per-request cap and a $0.25 daily allowance, and attached it to Claude Code through a hook around web fetching — when Claude hit the 402, the hook checked the price against the budget, paid, and returned the page plus receipt as context.[5] "The price was one cent. The buyer was a Claude Code workflow."[5] The qualification is the finding: "The experiment proves that the payment loop can work. It does not prove that today's major web crawlers have wallets" — every payment came from agents he controlled on testnet, and GPTBot, ClaudeBot, PerplexityBot and Googlebot "should not be expected to arrive with wallets capable of purchasing access."[5]
The toll market now has a three-layer count: claimers outnumber servers (32 claim, 7 serve), and servers outnumber payers (a few hundred dollars a day of amount-matched settlement across ~200 addresses; a real small seller watching 3,352 requests with zero payment headers).[2][3][4] The supply side is scaling — Cloudflare's gateway went beta with named sellers; 10 of 10 independently probed live services answered; the loop demonstrably works end to end, budget guardrails included.[1][2][5] The demand side reads tiny, and now it has an instrument that can re-read it — the next measurement is to watch the on-chain series leave its first day and stop being one day old, and to watch whether the gateway's named sellers show up as payers in it.[3] Until an independent agent with real funds decides a third-party resource is worth its price, the machine toll remains a machine-readable price list with almost nobody at the counter.[4][5]
[1] Monetization Gateway beta: charge AI agents for consumption with HTTP 402 (Cloudflare, 2026-09-30)"The Monetization Gateway lets sellers charge agents for any resource behind Cloudflare's network, priced per use.""AI Gateway has a complex pricing engine powering how each token gets billed.""To start, Stocktwits built a separate, agent-facing path for these requests, with Cloudflare's Monetization Gateway sitting in front of it.""API2PDF now uses the Monetization Gateway to return an HTTP 402 response when a user or agent makes a request without an API key."
[2] We Found Twenty-Five Live x402 Services. One Was In Our Catalog. (APIs.io, 2026-09-11)"Ten of ten answered with a real challenge.""One was in our catalog.""The first pass probed each service's base URL and found zero adopters.""An x402 challenge lives on the paid resource, not at the root.""Thirty-two providers carry the x402 tag. Seven serve a verified challenge."
[3] How big is the x402 market in September 2026, measured on-chain (Quietforge)"our own confirmed payments are zero in every window so far""about 11,900 to 13,500 amount-matched pay-per-call payments settle every 24 hours""In the trailing 24-hour windows we measured between 22 and 23 September 2026""the average confirmed payment is about two cents"
[4] Who actually connects to a small x402 API? A 31-hour census of 83 clients (Quietforge)"not one carried a payment header""on a small, never-paid x402 API, the traffic you get is almost entirely trust monitors, uptime probes, registry crawlers and schema scanners"
[5] Claude Paid a Website to Read One Page (netcontentseo)"The price was one cent. The buyer was a Claude Code workflow.""The experiment proves that the payment loop can work. It does not prove that today's major web crawlers have wallets.""GPTBot, ClaudeBot, PerplexityBot and Googlebot should not be expected to arrive with wallets capable of purchasing access""An HTTP paywall only creates a market when the client on the other side knows how to pay."