AI agents stall at human paywalls, so payments need to become a machine-readable credential for accessing content and APIs.
2
x402 supports low-cost machine-to-machine payments, while AgentCore Payments adds wallets, spending limits, expiry times, and a payment path separate from the agent's reasoning loop.
3
AWS bot detection and AI traffic monetization let publishers price requests by URL path, bot identity, and whether the request is for training or search.
Summary
Anil Nadiminti argues that web payment systems built around human subscriptions and card transactions do not fit autonomous agents. Agents may need to pay a fraction of a cent for one API call, while card rails impose a 25-cent minimum plus a percentage fee. When agents meet paywalls, humans must intervene, which breaks the autonomous workflow. Sellers face a choice between blocking bot traffic and losing discovery and licensing opportunities, or allowing it and paying the infrastructure cost without attribution. Nadiminti presents x402 as a protocol for requesting payment, authorizing it, settling through a facilitator, and then returning the content. On AWS, AgentCore Payments supplies wallet support, connectors, spending controls, and protected key storage. On the seller side, AWS WAF bot detection can identify bot types, verify signatures, infer intent, and apply different prices at the edge without changing the origin or SDK.
Autonomous agents stall when content requires a human payment step
Nadiminti begins with a familiar news-site paywall. A person can enter card details or use a subscription, but an agent cannot continue when the site asks for those credentials. The human then has to enter the loop and complete the transaction for the agent. That manual step breaks the autonomous workflow. He describes the progression from LLMs answering questions, to copilots helping with work, to agents using reasoning to complete multi-step tasks. In this model, an agent needs to access resources and settle payments on its own. Nadiminti says the subscription model is moving from humans in the loop toward humans on or out of the loop.
Sellers lose something whether they block bots or let them use content for free
Nadiminti describes the seller's two existing choices. Blocking bots gives up AI-powered discovery, partnership and licensing opportunities, and citations in AI responses. Allowing bots through can expose the infrastructure to hundreds of thousands or millions of requests, raising operating costs. It also makes attribution and control of the intellectual property harder. He argues that sellers need a way for agents to pay for the material they request. In his framing, the buy side needs agents with wallets and controlled microtransactions, while the sell side needs to understand which bots are making requests and monetize them at the edge without rebuilding the origin system.
Card transaction fees make tiny agent purchases uneconomic
The talk focuses on the mismatch between card payments and agent requests. Nadiminti cites a 25-cent minimum transaction fee and an additional 2.5 percent charge. Agent requests may cost a cent, a sub-cent amount, or a microcent. Adding the minimum fee to a tenth-of-a-cent purchase can make the payment roughly 250 times the value of what was bought. That makes a normal subscription or card transaction unsuitable for paying separately for many small API calls. He says the desired model is real-time, pay-per-use execution, where payment itself provides the credential needed to receive the resource.
x402 turns an HTTP payment-required response into a machine payment flow
Nadiminti explains x402 through the previously reserved HTTP 402 status code, Payment Required. A client requests a resource, and the server responds with the required payment details. The client chooses a payment method and sends payment authorization. A facilitator verifies the authorization and completes settlement. After on-chain settlement, the server returns the content. He says the protocol avoids API-key setup and subscriptions, has no protocol fee for the consumer's microtransaction, and gives the merchant a nominal gas fee. He also describes x402 as extensible and says it is under Linux Foundation open governance, with support from Coinbase, AWS, Google, Stripe, Anthropic, Cloudflare, and Circle.
AgentCore Payments adds wallets and bounded payment sessions
AWS AgentCore Payments lets agents discover, authorize, and execute payments with a few lines of code. Nadiminti says it supports wallets brought from Coinbase and Stripe in preview, and uses payment connectors to orchestrate transactions. The service currently supports x402 and is designed to add other protocols. Enterprises can create payment sessions with a maximum amount and an expiry time. His example is an agent allowed to spend $5 over 30 or 60 days. Built-in observability gives teams visibility into activity, while the spending limit prevents an agent from using a wallet or credit card without bounds.
The payment system keeps private keys away from the agent
When a wallet is imported, its secret keys are stored in a secure token wallet backed by AWS KMS. The agent cannot access the private keys. AgentCore Payments can also connect through AgentCore Gateway, which exposes internal APIs and connects to Coinbase discovery, where Nadiminti says more than 10,000 endpoints are available for transactions. The design separates the agent infrastructure from the payment infrastructure. The agent continues its own tool and reasoning loop, while payment connectors, wallet integrations, limits, and settlement operate in their own path. Nadiminti presents this separation as a control against an agent spending beyond its intended budget.
Payment execution stays off the agent loop because skills and inputs can be poisoned
Nadiminti says skills and agent inputs can be poisoned by malicious actors. For that reason, payment should not run on the agent's nondeterministic reasoning path. The payment layer handles a 402 response, applies connectors and limits, and reports the completed settlement back to the agent. He says the agent's code does not need to change, and developers can bring their own model and framework. Policies and pending controls can remain outside the payment stack. The separation gives payment execution a more deterministic path while leaving the agent free to perform its normal work.
On the seller side, Nadiminti describes AWS WAF bot detection as identifying more than 650 types of bots, including Perplexity, GPT, Claude, and Google bots. The system can verify a bot through its signature and infer why it is requesting content. A request may be for model training or for a retrieval-augmented search response. AWS AI traffic monetization can sit behind CloudFront and WAF, and Nadiminti says publishers can begin without SDK changes or origin changes. Publishers keep 100 percent of the revenue, according to his description. Internal APIs exposed through AgentCore Gateway can use the same edge controls.
Publishers can set prices by path, bot identity, and intent
Nadiminti gives three dimensions for pricing AI requests. A blog path can have a different price from a research path or an API endpoint. A verified partner can receive a different price from an unverified bot. Training traffic can be priced differently from search traffic. These rules can be combined with AND and OR conditions. Publishers can also choose whether humans access content freely or pay a separate price. Dashboards show revenue by bot and the paths those bots access, giving publishers information for deciding how to structure the pricing model.
"It's important to decouple them because skills can be poisoned, inputs for the agents can also be poisoned by inputs as well."12:52
Who should watch
You are building agents that need to buy API calls, premium content, compute, or other online resources without stopping for human approval.
Your team needs spending limits, wallet protection, and observability before giving agents the ability to transact.
You publish content or APIs and want to charge AI traffic without changing the origin or adding an SDK.
