Updated 2026-11-03: the dispute cascade holds no funds and reaches an agent that stops answering, and the payment is outside MintID. Updated 2026-10-19: the operator’s name.
On July 1, 2026, Cloudflare launched its Monetization Gateway, according to Cloudflare’s announcement of 1 July 2026. Any customer can now put a per-call price on any resource, such as a page, an API, a dataset, or an MCP tool. The customer gets paid in stablecoins by whoever calls the resource. The mechanics run on x402, the open protocol that finally puts HTTP 402 “Payment Required” to work. The server quotes a price, and the agent pays wallet-to-wallet, retries with proof of payment, and gets the resource. A year after Pay Per Crawl, the pay-per-use agentic web is shipping infrastructure.
We think this is right, and it solves half of the problem. The new stack answers “did this request pay?” and, through Web Bot Auth, “which software fleet sent it?”. It does not answer the question every seller, regulator and dispute process eventually asks: if this agent causes harm, is there an accountable human behind it?
Why x402 and Web Bot Auth do not cover the long tail of agents
x402 settles value without accounts, signups, cards on file, or identity. A wallet is enough. Web Bot Auth authenticates operators cryptographically. It works today because the calling population is limited to named crawler fleets whose signing keys sit in known registries. Between the two protocols, payments clear and big-fleet traffic is attributable.
The gateway is built for the coming long tail of purchasing agents, research agents, and booking agents. Individuals and small companies run these agents to transact with counterparties they have never seen. For that population, “which fleet signed this?” has no useful answer. Every marketplace then falls back on an allowlist of companies large enough to negotiate with. This fallback quietly recreates the gatekept web that the open protocols were meant to avoid.
Why public directories and allowlists fail for agent verification
The gateway’s own design shows the gap. Sellers can price differently for verified callers, making calls free for partners, paid for strangers, and refused for anonymous scrapers. Verification tiers look like where agentic commerce is heading. That leaves the question of what “verified” means when the caller is one agent in a long tail outside the household-name AI companies.
If “verified” means registered under its operator’s legal name in a public directory, the agentic web gets a surveillance index of who runs what. Every paid request then extends the dossier. If “verified” means nothing checkable, fraud teams return to allowlists. Twenty years of identity systems assumed a human at the keyboard. Both defaults fail without one.
How MintID proves human accountability in zero knowledge
MintID’s agent KYC is built to supply verifiable human-backed agent identity in zero knowledge. This is MintID’s answer to what the market calls Know Your Agent (KYA). An agent carries a credential derived from its principal’s one-time KYC with an accepted issuer. An accepted issuer is a KYC organisation admitted on-chain to issue credentials. At transaction time, the agent presents a proof valid for ten seconds. The proof shows only that an accountable, KYC-verified human principal stands behind this agent, at a stated assurance grade (A1–A4), within a delegated scope that covers this purchase. The scope axes are specified, and enforcement arrives with the agent products. The presentation reveals no name, no wallet-to-operator mapping, and no handle that links this seller’s log to any other seller’s log.
MintID specifies a dispute cascade that keeps principals accountable without exposing their identity on every call. The accountable principal is the recourse. A claim reaches the person behind the agent through the issuer, and that person may settle directly without anyone learning who they are. A contested claim goes to an independent arbiter, and identity is released only under the arbiter’s certified finding. The claim reaches the agent even if it stops answering: every agent presentation carries an encrypted reference to the agent that only its issuer and the MintID Foundation together can open, and only for a recorded claim. MintID holds no funds at any step, and the cascade is specified, not built. Under this design, sellers would get recourse and operators would not get profiled.
Why per-request payments require unlinkable credentials
Without privacy engineering, a pay-per-use web logs everything. Every priced call is a timestamped, paid, attributable event. Combining per-request payments with a stable agent identifier creates a behavioural record of every paid call. That record is queryable after the fact and sits one subpoena or one breach away. The fix has to live in the credential layer: presentations that are unlinkable across verifiers and across sibling agents, so that a proof works like cash rather than like a card statement. That property keeps the identity layer from turning per-request payments into a cross-site tracking record. The payment itself is outside MintID, which holds no payment key, chooses no payer address and settles nothing. Whether a payment links its payer across sellers depends on the wallet and the payment scheme, not on the identity layer.
We expect sellers to price by verification
Payment (x402), software identity (Web Bot Auth, in the IETF process as of July 2026) and accountable-principal proofs are complementary layers. We expect “price by verification” to become the default posture of agent-facing sellers. We also expect verification to split into fleet signatures for a few named crawler operators and credential proofs for everyone else. MintID is an identity protocol on which accepted issuers back those proofs and verifiers check them, with no personal data of holders written to the chain. Its bet is that the actual economy will live in the “everyone else” tier. MintID has been in production on the single-node production chain since 20 September 2026, operated by Conectia, a disclosed related party. MintID is designed to scale to a public proof-of-stake network. The specifications are frozen, the verifier service and a client are built, and the proof core is in production. The audits are scheduled milestones whose findings are published.