Answer Engine Optimization is incomplete without HTTP-layer payment support—Cloudflare's edge position makes it the key player connecting agent visibility to agent commerce.
Adapted from @JulioMCruz# AEO finds you. The 402 is how the agent pays. The next customer may never see your homepage. They ask an assistant. The assistant names a vendor, or it does not. That moment used to be a search ranking. It is now a recommendation inside a model. That is Answer Engine Optimization. Here is the weak point first. A recommendation is not a purchase. A citation is not a receipt. If you only optimize to be named, you are doing SEO for chat. @Cloudflare said this out loud on 6 August 2026. In Agent Readiness, the commerce checks (x402, ACP, UCP, AP2) are informational for now, and not counted in your score. @Cloudflare expands ACP as Agent Commerce Protocol. The official name is Agentic Commerce Protocol (@stripe and @OpenAI, 29 September 2025). The dashboard will tell you whether @AnthropicAI Claude or @OpenAI GPT mentioned you. It will not tell you whether an agent paid you, or whether you can prove it. What this tells me: AEO without a 402 is incomplete infrastructure. The agent that can find you still cannot buy the page, the API, or the crawl unless payment is in the HTTP exchange. That is why x402 and MPP matter. And that is why @Cloudflare is the player to watch. They sit on the request path. # The stack, in order Four jobs got collapsed into one marketing phrase. They are not the same job. 1. Control. Who is allowed to read you. 1. Readiness. Can an agent parse you once it is allowed in. 1. Visibility. When a person asks an assistant, do you get named. 1. Payment. When the agent wants the resource, can it pay in the same request. Identity sits under all four. A crawler that can spoof another crawler is not a counterparty you can bill. I would not ship a site that only does step 3. # Cloudflare is not an AEO vendor. It is the edge. Most AEO tools sit outside your traffic and poll models. @Cloudflare already sees the request. On 6 August 2026 they folded Agent Readiness into the dashboard and added the AEO Visibility tab. Matthew Conroy and Jack Galilee wrote the post. The claim they are measuring, not only estimating, is because the crawl and referral numbers pass through their network. Three products around that tab are the ones that actually change the economics. ## AI Crawl Control Not all AI traffic is one bot. @Cloudflare now splits it by behavior: Search, Agent, and Training. You can allow, block, or block only on pages that show ads. Free plans get the same three buckets. Search is the crawler that indexes you and is supposed to send readers back. Agent is the fetch that happens in real time on a person's behalf (chat fetch, browser-use). Training is the crawler that takes your text to train or fine-tune a model. Starting 15 September 2026, new domains onboarding to @Cloudflare get new defaults: Training and Agent blocked on pages that display ads, Search left allowed. The same-day press also says existing Free customers who have not changed settings flip that day. Changelog and blog do not. I am not picking one. Multi-purpose crawlers that mix Search and Training (Googlebot, Applebot, BingBot) follow the most restrictive rule you set. You can opt out before that date. If you still have one "Block AI bots" toggle in your head, you are already behind your own edge. ## Agent Readiness This is the technical checkup. Diagnostics fetches the site the way an agent does: robots.txt, sitemap, headers, a Markdown copy, published auth and tool metadata. The score runs from Not Ready to agent-native. Checks come back pass, fail, or neutral, with the exact request they saw. Effort tiers, as @Cloudflare groups them: - Quick wins: crawler-readable robots.txt, XML sitemap, AI-crawler rules, clean Markdown for agents. - Technical groundwork: Content Signals, API catalog, link headers, agent login instructions. - Advanced: OAuth discovery, MCP and A2A agent cards, skills index, Web Bot Auth, WebMCP. - Commerce: x402, ACP, UCP, AP2. Informational. Not in the score. The scanner at isitagentready.com launched 17 April 2026. The August dashboard folded that work in. Do not call Agent Readiness an August launch. ## Pay Per Crawl 1 July 2025. Private beta. This is where @Cloudflare put HTTP 402 back on the public web for crawlers. A publisher sets a flat per-request price. For each crawler they pick Allow, Charge, or Block. If the crawler has no billing relationship, Charge still returns a network-level denial, but the 402 tells the crawler a paid relationship could exist later. The flow is HTTP, not a sales call. Reactive: the crawler hits a paid URL, gets 402 Payment Required plus crawler-price. It retries with crawler-exact-price if it accepts. Proactive: the crawler sends crawler-max-price on the first request. If your price is at or under that cap, @Cloudflare serves 200 and crawler-charged. Identity is Web Bot Auth. The crawler registers an Ed25519 key, then signs with signature-agent, signature-input, and signature. Without that, anyone can pretend to be a paying crawler. Settlement is not on-chain in this beta. @Cloudflare is Merchant of Record. It aggregates events, charges the crawler, and pays the publisher. Later they proposed a deferred-payment scheme on x402 so a crawl-heavy agent can batch the day instead of settling each page. That scheme is a proposal, not a claim I would treat as shipped for every site. Pay Per Crawl is how a publisher charges a crawler at the edge. It is not yet any agent, any API, any wallet. ## AEO Visibility Once the agent can read you, the question becomes: does the assistant recommend you. @Cloudflare infers your industry and category, then probes @AnthropicAI Claude and @OpenAI GPT with buying-style prompts. Metrics they name: Citation Rate, Prominence, Mention Rate, Share of Voice, plus an Industry Fit score from a category baseline they compute once and reuse. They do not re-query the models on every scan. That is why results load fast. It is also why this is a snapshot, not a live ranking. Next to that, AI Operator Activity shows real crawl and referral traffic per operator. The pattern they flag is the operator that crawls thousands of pages and sends nobody back. Early access. Request it from the Overview tab. I would not treat those citation rates as a sales forecast. # x402: Coinbase built the protocol. Base is the cheap settlement. This is the part people get wrong. On 6 May 2025 @Coinbase launched x402 as an open protocol that puts stablecoin payment into HTTP. Erik Reppel (@CoinbaseDev) is named as creator and whitepaper co-author. The Linux Foundation, on 2 April 2026, said it in one sentence: The x402 protocol, created by Coinbase, is moving to the Linux Foundation. @base did not author x402. @Coinbase's own launch text used Base as the reason micropayments became practical: modern L2 fees dropped to about a cent, so the old HTTP 402 idea finally had a rail. Base is also on the Foundation member list, next to Coinbase, Cloudflare, Stripe, AWS, and the card networks. Tag @base for the rail. Do not tag @base as the inventor. The Foundation itself was initially developed by @Coinbase, @Cloudflare, and @stripe. @awscloud is a founding member. By July 2026 the Foundation was operating under Linux Foundation with dozens of members. x402.org is the public site. docs.x402.org is the integration guide. @Coinbase's own FAQ: x402 is not a Coinbase product. It was incubated there and contributed to the Foundation. The mechanic is simple on purpose. 1. Client requests a resource. 1. Server returns HTTP 402 with price, asset, and where to pay. 1. Client pays (stablecoins; the protocol is not tied to one chain) and retries with proof. 1. A facilitator can verify so the origin does not need its own chain node. 1. Server returns the resource. No account. No API key. No checkout page. @Cloudflare Agents docs name the headers as PAYMENT-REQUIRED, PAYMENT-SIGNATURE, and PAYMENT-RESPONSE. Networks in production depend on the facilitator. The @CoinbaseDev facilitator has been documented on Base, Polygon, Arbitrum, World, and Solana. x402.org says the protocol is blockchain-agnostic (EVM, Solana, and more) and extensible toward traditional payment methods. I would not write that x402 is only USDC on Base. I also would not write that x402 already is Visa. @Cloudflare's next step after Pay Per Crawl is the Monetization Gateway: charge any resource behind Cloudflare (a GET, an MCP tool, an unauthenticated caller turned from 401 into 402) using x402, with settlement into the seller's wallet. That is the product that turns a crawl price into a general paid HTTP edge. Treat launch status as whatever the live blog says the day you publish. Do not invent GA. @awscloud has been wiring the same 402 into CloudFront and WAF so a publisher already on that stack can return 402 to an agent. AWS is also in AgentCore Payments with @Coinbase and @stripe. That is distribution, not authorship. What x402 does not do by itself: decide who the agent is, orchestrate the next hop, or give you a job-level receipt that outlives the HTTP response. PAYMENT-RESPONSE is the settlement acknowledgement on that call. The spec's signed offer-receipt extension is off by default. It is not credit assignment across a multi-agent job. # MPP: Tempo and Stripe, not Stripe alone Machine Payments Protocol is the other HTTP 402. @stripe published the launch post on 18 March 2026 (Jeff Weinstein and Steve Kaliski): an open standard, internet-native way for agents to pay, co-authored by Tempo and Stripe. @tempo is the payments L1 incubated by Stripe and Paradigm. Tempo's own FAQ says MPP is not limited to Tempo. Tempo is one settlement option for stablecoin payments. Stripe is a co-author, not the sole owner. If you only tag @stripe, you erase Tempo. If you only tag @tempo, you erase the card rail. The IETF document is draft-ryan-httpauth-payment-01, titled The Payment HTTP Authentication Scheme. Three Tempo Labs authors, then two Stripe authors. It is an individual Internet-Draft. The datatracker says it is not endorsed by the IETF and has no formal standing in the standards process. The draft header says intended status Standards Track. That is an intent, not adoption. It is not an RFC. Wire: the server returns 402 plus WWW-Authenticate: Payment. The client retries with Authorization: Payment. Success may carry Payment-Receipt. Intents named on mpp.dev: charge, session, subscription. mpp.dev FAQ says Tempo stablecoins, cards (Card or Stripe), and Lightning are in production. The /protocol table only lists Tempo and Stripe with a Production badge. I would not collapse those two pages into one list. @stripe users accept MPP through PaymentIntents, in stablecoins and in fiat (cards and BNPL via Shared Payment Tokens). Funds land in the existing Stripe balance, in the merchant's default currency, on the normal payout schedule. Tax, fraud, refunds, and accounting stay on the Stripe stack the merchant already runs. @Cloudflare and mpp.dev say MPP clients can consume existing x402 exact services without changing those services (mppx reads both header sets). @stripe does not repeat that sentence. Stripe docs treat MPP and x402 as two integrations they support. Do not put the Cloudflare sentence in Stripe's mouth. An agent that only speaks one 402 will still bounce off the other half of the paid web. @stripe named early MPP users: Browserbase (pay per headless session), PostalForm (print and mail), Prospect Butcher Co. (agent-ordered sandwiches in New York), Parallel Web Systems (pay per API call for web access). Those are existence proofs, not a market size. What MPP does not do yet: it is not an IETF standard. A draft can change. Latency and sub-cent claims belong to the vendors. I would not put them in my own voice. # Why both rails are the key for agents that buy web services AEO answers: does the assistant know I exist. x402 answers: can the agent pay this HTTP resource in stablecoins, without an account. MPP answers: can the agent pay this HTTP resource on more than one rail, including a card the merchant already settles at @stripe, with a header scheme filed as an individual IETF draft. Pay Per Crawl answers: can I charge the crawler at my edge this week, even if I am not ready to take a wallet payment. They stack. They do not replace each other. The agent that buys a web service has to do all of this in one loop: - Know who it is (Web Bot Auth, or an agent identity standard, not a spoofable User-Agent). - Discover the price (402, not a pricing page a human clicks). - Pay (x402 or MPP). - Receive the resource. - Keep a receipt that you can audit later. If any step is a Slack message to finance, the agent is not a customer. It is a demo. @Cloudflare is important because they can enforce the first four on the same request: block Training, allow Search, score whether Claude cites you, and 402 the Agent fetch. @Coinbase is important because they wrote the open 402 that does not need a Stripe account. @base is important because that is where a lot of that 402 actually settles. @stripe and @tempo are important because most merchants will not stand up a wallet to get paid by an agent. They will turn on PaymentIntents. I would not pick a religion. I would implement the 402 I can settle, and speak the 402 the other side already speaks. # What I would not ship - I would not tell a publisher that an AEO citation rate is revenue. - I would not turn on Pay Per Crawl and call it x402. Different headers, different settlement, @Cloudflare in the middle as Merchant of Record. - I would not tell a founder that @base created x402. @Coinbase created it. Base is the rail. - I would not tell a founder that @stripe created MPP alone. @tempo co-authored it. Stripe incubated Tempo. - I would not treat ACP, UCP, or AP2 as solved because they appear on @Cloudflare's informational commerce list. They are named. They are not scored. ACP is checkout (@stripe and @OpenAI). UCP is the commerce lifecycle (@Google launched it). AP2 is payment authorization (Google, later donated to FIDO). I will not pretend they are interchangeable with x402. - I would not give an agent a treasury because a testnet or a playground returned 200. # What I would do this week If you run a site: open Agent Readiness. Fix robots.txt, sitemap, and Markdown for agents before you argue about share of voice. Set Search / Agent / Training as three rules, not one panic toggle. Decide what an Agent fetch is worth. If you cannot price it, you are not ready to be paid. If you sell an API or an MCP tool: return 402 with a real price. Support x402 so an agent with a wallet can pay. Support MPP so an agent coming through @stripe can pay. Put the receipt on the paid action, not in a log you hope someone reads. If you write AEO content: write pages an agent can quote and a 402 can gate. A blog post that ranks in Claude and then 403s the fetch is how you train the model to recommend your competitor. Identity, then payment, then receipt. Then orchestrate. AEO is the discovery layer on top of that. It is not a substitute. @Cloudflare @Coinbase @base @stripe @tempo @awscloud @OpenAI @AnthropicAI # Sources 1. https://blog.cloudflare.com/aeo/ 1. https://blog.cloudflare.com/introducing-pay-per-crawl/ 1. https://www.coinbase.com/developer-platform/discover/launches/x402 1. https://stripe.com/blog/machine-payments-protocol 1. https://www.linuxfoundation.org/press/linux-foundation-is-launching-the-x402-foundation-and-welcoming-the-contribution-of-the-x402-protocol/ 1. https://datatracker.ietf.org/doc/draft-ryan-httpauth-payment/ 1. https://www.agenticcommerce.dev/
