Cloudflare resolves identity, permission, and payment inside a single request at the edge using Web Bot Auth for cryptographic identity, behavior classification for permission, and the x402 protocol for payment, so the origin only receives requests after all three are settled.

The design goal for recent changes is to resolve identity, permission, and payment inside a single request, at the edge, before the origin responds. ... Identity: The traditional identifier, the User-Agent string, can be set to any value by the caller, so it offers weak assurance. Cloudflare's answer is Web Bot Auth, an authentication method that uses cryptographic signatures in HTTP messages to verify that a request comes from a particular automated source. ... Payment: This comes last and is attached to the request through x402. ... The exchange runs through a short sequence that can be compared to a small state machine. A client requests a resource that sits behind a price. Rather than returning the resource, the server responds with 402 and a small payload stating the price, the accepted asset, and where to pay. The client re-sends the same request with proof of payment attached. A facilitator verifies the payment, and the server returns the resource. Two properties make this suitable for machine traffic. The payment amounts can be very small because the protocol adds almost no overhead to the request. And the payment itself serves as the credential, so a buyer with no prior relationship can access the content by showing the proof of payment.

Read full article ↗excerpt · fair-use quotation