When AWS shipped native x402 support for CloudFront and WAF into general availability in June 2026, it quietly changed the economics of running content and APIs on the internet. For the first time, a hyperscale CDN could return an HTTP 402 Payment Required response at the edge and settle a stablecoin payment before serving a byte of origin content. I have spent the last several weeks wiring this into test distributions, and this guide walks through what it is, how the flow works, and the practical steps to turn AI traffic into revenue at the edge.
x402 is a payment protocol built on the long-dormant HTTP 402 Payment Required status code. Instead of a subscription or an API key, the server answers an unpaid request with a machine-readable description of what it costs. The client, usually an autonomous agent or an AI crawler, reads that description, attaches a signed stablecoin payment, and retries.
What AWS added in June 2026 is the ability to run this handshake inside CloudFront itself, enforced by AWS WAF. The important detail from the launch is that it carries no additional charge layered on top of your existing WAF usage. You are not paying for a new managed product; you are configuring rules on infrastructure you already run. AWS positioned it as the first hyperscale deployment of x402 at the edge, which matters because edge enforcement means the paywall is evaluated in hundreds of points of presence before a request ever reaches your origin.
That last point is the whole pitch. When an AI crawler hits a paywalled path, the 402 is returned from the nearest edge location. Your origin servers stay idle, you pay no egress for content you never served, and unpaid scraping is rejected cheaply.
The mechanics are a two-round-trip exchange. Here is the sequence I see in the logs:
402 Payment Required with a JSON body describing the accepted payment.X-PAYMENT header.X-PAYMENT-RESPONSE confirmation.A typical 402 body looks like this:
{
"x402Version": 1,
"accepts": [{
"scheme": "exact",
"network": "base",
"maxAmountRequired": "10000",
"resource": "/datasets/market-feed.json",
"asset": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
"payTo": "0xYourReceivingAddress"
}]
}
The asset here is USDC on Base, and maxAmountRequired is in the token's smallest unit (10000 = $0.01 for 6-decimal USDC). The agent signs an authorization the server can later submit on-chain, so the buyer never needs an interactive wallet popup. That is what makes the flow viable for fully autonomous clients.
I want to be honest that the exact console layout keeps shifting, so I will describe the shape of the configuration rather than pretend there is one magic button. The building blocks are consistent:
/premium/*, /datasets/*, or an MCP tool endpoint. Free paths keep serving normally.X-PAYMENT header.The critical mindset shift: pricing is per-request and tiny. You are charging fractions of a cent per fetch, betting on volume from machine traffic rather than a handful of human subscribers.
The reason this rides on WAF and not a bolt-on service is that WAF already sees, classifies, and filters every request at the edge. AI crawlers and agent traffic are exactly what WAF is good at fingerprinting. Rather than simply blocking a scraper, you now have a third option beyond allow and deny: charge.
In practice I set up a rule group that does three things. First, it identifies likely automated or AI-agent traffic on the monetized paths. Second, it checks whether a valid payment is present. Third, it returns the 402 challenge when payment is missing and passes the request through when it is present. A simplified rule intent looks like:
IF request.path matches "/datasets/*"
AND header "X-PAYMENT" is absent-or-invalid
THEN respond 402 with payment-requirements
ELSE allow
Because this runs inside WAF at no extra product cost, the marginal expense of rejecting an unpaid crawler is effectively the WAF request evaluation you were already paying for. That economics is what makes edge monetization worth trying rather than theorizing about.
A few things surprised me when I first ran CloudFront 402 payments in anger, and they are worth flagging honestly.
None of these are dealbreakers, but they are the difference between a demo and a production paywall.
The obvious comparison is Cloudflare's Monetization Gateway, which opened its waitlist on July 1, 2026 and also uses x402 to charge for pages, datasets, APIs, and MCP tools, including a deferred pay-per-crawl scheme. The two converge on the same protocol, which is genuinely good news, because it means a paying agent does not care which edge it hits.
The differences are operational, not conceptual. AWS's offering went GA in June 2026 and folds into WAF you may already run, which suits teams deep in the AWS ecosystem with existing distributions. Cloudflare's gateway leans into pay-per-crawl as a first-class publisher feature and started later as a waitlisted product. If you already terminate traffic on CloudFront, AWS x402 is the path of least resistance. If your stack is Cloudflare-native, their gateway will feel more integrated. I would not migrate a CDN just for this; use whichever edge you already own.
Does enabling x402 on CloudFront cost extra? Per the June 2026 GA announcement, there is no additional charge on top of your existing AWS WAF usage. You pay for WAF request evaluation as before; the x402 enforcement rides on it.
What can a human visitor do when they hit a 402? Not much, which is why you should only gate machine-oriented paths like datasets, APIs, and MCP endpoints. A standard browser has no built-in way to satisfy an x402 challenge, so keep human-facing pages on free routes.
Which stablecoin and network do I use? USDC on Base is the common default in current x402 deployments because settlement is cheap and fast, but the protocol lets you advertise the asset and network you prefer in the 402 response.
Is this the same standard Cloudflare uses? Yes. Both AWS and Cloudflare build on x402, so a well-behaved agent can pay either edge without custom code per provider.
AWS x402 on CloudFront takes an idea that lived in whitepapers and puts it on infrastructure most engineering teams already operate. The honest summary: the June 2026 GA gives you edge-enforced, per-request stablecoin payments with no product surcharge beyond WAF, aimed squarely at the flood of AI crawler and agent traffic that used to scrape for free. It is not a subscription replacement and it is not for human visitors. But for anyone serving datasets, APIs, or tool endpoints to machines, it is the cleanest way I have found to turn that traffic from a cost center into a metered revenue line. Start with one low-stakes path, watch the conversion, and price from there.