Why agents need a native way to pay

Most software today was built for human users, not for AI agents. An agent trying to adopt a new API often faces a login page designed for people, a payment flow that requires a human to type in a card number, and an API key generation step buried inside a dashboard. The harder blockers are structural: agents lack a stable identifier to sign up with and have no native mechanism to pay for usage. When these tasks stall, the agent kicks registration and billing back to a human, which defeats the purpose of autonomous workflows and makes it impractical for agents to evaluate many APIs side by side.

Cloudflare is addressing this with Cloudflare Wallets, announced today. Users can already claim a wallet handle for their Cloudflare account at cloudflare.pay, which provides a unique username for connecting with merchants. Payment capability — funding the wallet and using it to buy APIs and content — will arrive soon.

The wallet pairs with the previously announced Monetization Gateway, which lets Cloudflare customers get paid for their websites and applications. Monetization Gateway supports micropayments via the x402 protocol, allowing payments to be attached to HTTP requests. These micropayments can cover everything from AI inference to data to content. A wallet is required to pay for services behind Monetization Gateway and other x402-compatible endpoints.

Cloudflare Wallets will let users store stablecoins, buy services, and receive funds across the web. Each account with a wallet can create Virtual Wallets for its agents so they can purchase APIs, MCP tools, content, and more. Wallet users may share their handles, giving them a stable identity when transacting with merchants.

Account Wallets versus Virtual Wallets

Two wallet types will be available:

  • Account Wallets are for humans who own or use Cloudflare accounts. They can add funds, delegate spending to Virtual Wallets, and remove funds.
  • Virtual Wallets are for agents and operate via API keys. Each Virtual Wallet can spend only up to a cap set by the Account Wallet owner, giving agents room to act without manual approval while preventing overspending.

This setup is meant to make agents more useful, not less constrained. Spending caps let a human hand an agent a budget like $10 and let it explore freely, confident that a few-cent API calls cannot cause damage. An agent responsible for $1,000 would warrant far more scrutiny, so the low ceiling on a Virtual Wallet is paradoxically what gives the agent its independence.

Account Wallet policies act as cost controls for the Virtual Wallets they fund. An administrator could provision an Account Wallet with a weekly $100-per-employee budget for AI inference by creating a Virtual Wallet for each employee with that rule. When an agent or employee exceeds a limit, they can request a manual override from an authorized human. Anomalies like unusually fast spending can be reviewed: if intentional, the admin raises a limit or approves a one-time injection; if not, the cap contained the damage.

Cloudflare says it will start with straightforward onramping and offramping of funds in supported geographies, with self-funding via stablecoins for eligible users as an alternative. The company points to its own traffic data showing a majority of web traffic is now bot-driven, making first-class payment and identity tooling for agents a pressing need.

Human-readable identities for agents

Delegation is only half the problem. Merchants interacting with an agent often have no idea who is behind it, which breaks models that depend on knowing the user. Trials, sign-up credits, and similar perks are easy to offer to a human or organization but hard to justify for anonymous agents — especially when one person can spin up dozens of them.

Linking wallets to a Cloudflare account via cloudflare.pay addresses this. Agents can optionally identify themselves as delegates of that account, with addresses like research.example.cloudflare.pay that tell a merchant which organization the agent represents. Declaring identity this way is optional, and businesses can decide whether to prioritize known agents. Cloudflare frames the distinction like VPNs: an unidentified party is not automatically untrustworthy, but they must prove themselves more — an approach already reflected in Turnstile and Bot Management.

This identity primitive extends existing work such as Web Bot Auth, which lets agents register an identity via a keypair. Wallet-linked IDs give that keypair a readable form, similar to how DNS pairs hostnames with IP addresses. Cloudflare is deliberately not proposing a new schema or verification system; instead, it wants to adopt identity standards that emerge from the x402 Foundation's work and encourage others to do the same.

The pieces of a headless marketplace

The combination of Monetization Gateway, Wallets, and identity forms the infrastructure for what Cloudflare calls a headless marketplace. Sellers can receive payments without traditional payment infrastructure; buyers can pay via agents without human intervention; and merchants can recognize or require identified buyers. Users can already claim a handle at cloudflare.pay to participate, with payment features to follow.