AWS WAF Can Now Bill AI Agents Through Stripe

On November 5, 2026, AWS said that AWS WAF AI traffic monetization can now settle agent payments through a Stripe connected account. Publishers and API providers can charge AI agents per request and receive local currency in their Stripe balance, without holding stablecoins or running a crypto wallet. It is the second half of a feature AWS launched on June 15, and it connects an HTTP 402 response at the edge to a normal Stripe payout.

The catch is in the details: the Stripe path has a $0.01 price floor, no test mode and a CloudFront-only scope. This piece walks through what changed, how the request flow works, the limits that decide whether it fits your API, and how it compares with Cloudflare's approach.

What AWS announced on November 5

AWS WAF is the firewall that sits in front of Amazon CloudFront, and the AWS WAF tool page covers the basics. In June, AWS added a Bot Control capability that lets a rule return 402 Payment Required to an AI bot or agent, with a price in USDC. The agent pays, WAF verifies the payment at the edge, and the content is served. At launch, payouts went to a stablecoin wallet you controlled, and AWS said Stripe integration was coming soon.

That integration is now live. You connect a Stripe account through Stripe Connect, set it as the payout method, and keep your existing pricing and agent policies. AWS says revenue from every payment provider appears in the same WAF console revenue analytics, and that the Stripe option adds no charge beyond standard AWS WAF pricing. Standard Stripe processing fees still apply.

How the 402 flow works

The mechanics follow the open x402 protocol, according to the AWS Developer Guide. A request reaches CloudFront, WAF evaluates your rules in priority order, and a rule with the Monetize action returns a 402 if the request carries no valid payment authorization. The 402 body tells the agent the price per request in USDC, the accepted networks (Base and Solana), the payee address, a maximum timeout and the payment scheme.

The agent signs a payment authorization with its wallet and retries the same request with a payment-signature header. WAF verifies it synchronously, lets the request through to your origin, and settles the payment only if the origin returns a 2xx. The response then carries a payment-response header with settlement details.

Three behaviors in the docs matter for anyone running a real API:

• No charge for origin failures. If your origin returns a 4xx or 5xx, settlement is skipped and the client is not charged.
• Single-use authorizations. Reusing a payment header without the payment-identifier extension returns a new 402.
• Safe retries. With the payment-identifier extension, a client can retry for up to 15 minutes without paying twice, but only if the client uses it.

Here is an illustrative exchange, simplified and not copied from AWS output. Field names and encodings in production will differ, so rely on the official docs for the exact format.

GET /reports/q3-pricing-data HTTP/1.1
→ 402 Payment Required (body: price in USDC, networks, payee, timeout)
GET /reports/q3-pricing-data HTTP/1.1 + payment-signature: <signed authorization>
→ 200 OK + payment-response: <settlement details>

What setup looks like with Stripe

You need a web ACL with CloudFront scope attached to a distribution. AWS recommends enabling the Bot Control managed rule group so that traffic is classified by identity, then adding Monetize rules that match paths, Bot Control labels or other request traits. Payment settings live in a MonetizationConfig on the web ACL or on a rule group.

For Stripe, you add a ConnectedAccountConfigs entry instead of a wallet address. You create the connected account in the AWS Billing and Cost Management console under Payment preferences, then reference its ARN. The IAM identity changing the web ACL needs the payments:GetConnectedAccount permission on that ARN. AWS WAF validates the account on every web ACL create or update, and the account must show Active status with crypto settlement Enabled.

A trimmed, illustrative fragment based on the shape in the AWS guide looks like this, with a placeholder ARN:

"ConnectedAccountConfigs": [{ "ConnectedAccountArn": "arn:aws:payments::<account-id>:connectedaccount/<name>", "PaymentNetworks": [{ "Chain": "BASE", "Prices": [{ "Amount": "0.01", "Currency": "USDC" }] }] }]

The limits that decide whether it fits

The Stripe route trades flexibility for convenience. AWS documents several differences from a self-managed wallet, and one Stripe-side condition deserves a check before you plan around it.

The price floor is the big one. At $0.01 per request, 100,000 paid requests would gross $1,000 before fees. That works for a data feed or a report endpoint. It does not work for a high-volume API that wants to charge a tenth of a cent per call, where you would need the wallet route or a bundled price per request.

No test mode on the Stripe path. AWS recommends validating policies in test mode, partly because its bot classification is probabilistic and may mislabel some traffic. With a connected account you test with real settlement. A practical workaround is to validate rules and pricing with a self-managed test wallet first, then switch the config. Treat that as a suggestion, not an AWS-documented procedure.

Stripe availability may apply. Stripe's own machine payments documentation labels the feature Frontier and says stablecoin payments are available to US businesses except New York, with other countries asked to email Stripe for access in 30+ countries. AWS's announcement does not say whether that gate applies to the WAF integration, so confirm with both vendors if you are outside the US.

What it means for builders and founders

The practical shift is that charging agents no longer requires application code. If your content or API already sits behind CloudFront, a rule can price it, bill by path and treat verified AI search crawlers differently from unverified agents. AWS lists six rule actions per verification tier: Monetize, Allow, Block, Count, CAPTCHA and Challenge, so you can mix free and paid access.

For a small team, the Stripe option removes the part most founders disliked: custody and accounting for stablecoins. Revenue shows up next to your other Stripe income, with the reporting, refunds and payouts you already use.

Three cautions before you flip it on:

• Demand is unproven. Neither AWS nor Stripe has published figures on how many agents pay today. Start with one low-risk path and measure.
• Clients must speak x402. Only agents with an x402-compatible runtime and a funded wallet can complete the flow. Everything else sees a 402 and leaves.
• Don't block your own agents. If you also run agents that read your site, make sure your Allow rules cover them so they are not caught by a Monetize rule.

If you build agents rather than serve them, expect more 402 responses over time. Give your agent a spending cap per task, keep the signing key out of prompts and logs, and log each paid call. Our guide to deploying an AI agent on AWS covers where those controls fit, and the Bedrock web search domain filtering piece shows how AWS already scopes what agents can fetch.

How Cloudflare compares

Cloudflare approaches the same problem differently. Its pay-per-crawl feature is in closed beta per its docs (last updated July 28, 2026): crawlers get a 402 with pricing, and Cloudflare acts as Merchant of Record. Separately, Cloudflare's Monetization Gateway documents x402 version 2 with PAYMENT-REQUIRED and PAYMENT-SIGNATURE headers, and it requires your origin to validate a signed token. On November 5 Cloudflare also published a post on agent identity and accountability and announced a Trusted Agent Delegation coalition, a reminder that who the agent represents is still unsettled. For the broader gateway picture, see our AI gateways comparison.

Verdict

If your content or API already runs on CloudFront and you want to test charging agents, enable the Stripe path on one narrow, valuable path and price it at $0.01 or more. It is the lowest-effort route to real agent revenue on AWS today, and it avoids stablecoin handling.

Skip it if you need sub-cent pricing, a test mode on the payment path, or a non-AWS stack. In those cases, use the wallet route for testing, or look at Cloudflare's options once they are available to you. Either way, check the Stripe company page and AWS company page here for related coverage as this market develops.

Sources

• AWS, AWS WAF AI traffic monetization now supports fiat payouts through Stripe (Nov 5, 2026)
• AWS, AWS WAF announces AI traffic monetization (June 15, 2026)
• AWS WAF Developer Guide: How AI traffic monetization works
• AWS WAF Developer Guide: Getting started with AI traffic monetization
• AWS WAF pricing
• Stripe docs: Machine payments
• Stripe newsroom: With Stripe, AWS enables AI agent payments (June 15, 2026)
• AWS News Blog: AWS WAF adds AI traffic monetization capability
• Cloudflare docs: What is Pay Per Crawl?
• Cloudflare docs: Monetization Gateway x402 protocol
• Cloudflare Blog: Agents aren't humans (but they kinda are) (Nov 5, 2026)