AWS Builder Center: Learn, Build and Connect with builders in the AWS community

AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.

How do I charge AI bots and agents for access to my content using AWS WAF AI traffic monetization?

7 minute read

Content level: Advanced

On June 15, 2026, AWS WAF added AI traffic monetization, a Bot Control capability that lets content and API providers charge AI bots and agents for access to protected resources directly at the edge. Instead of only allowing or blocking bot traffic, you can now return an HTTP 402 Payment Required response, verify a payment at the edge, and serve the content.

Overview

AI traffic monetization extends AWS WAF Bot Control with a new response type: instead of only allowing or blocking a bot, WAF can charge it for access. When a bot or agent requests a protected resource, WAF returns an HTTP 402 Payment Required response, verifies the payment at the edge, and serves the content. Traffic you would otherwise block becomes a revenue stream.

Under the hood, this uses the x402 protocol, an open standard for machine-to-machine (M2M) payments. The full exchange looks like this:

An AI bot or agent requests a monetized resource protected by an AWS WAF Web ACL on an Amazon CloudFront distribution.
AWS WAF returns an HTTP 402 Payment Required response with the price, accepted payment networks, and license terms.
The agent signs a payment authorization and resubmits the request with the payment proof.
AWS WAF verifies the payment at the edge, fetches the content from the origin, and serves the response.
A facilitator settles the payment on-chain, and the provider receives payouts in stablecoins.

The feature is available globally with Amazon CloudFront at no additional charge beyond standard AWS WAF pricing.

Enter image description here

A brief history of x402

The idea of charging tiny amounts for individual pieces of content, micropayments, is almost as old as the web. When HTTP was defined, the status code 402 Payment Required was reserved for exactly this purpose, then left unused for decades because no payment rail was cheap or fast enough to make per-request charging practical. Earlier attempts, from digital-cash schemes to systems like GNU Taler, never reached broad adoption.

x402, developed by Coinbase, revives that dormant 402 status code and turns it into a programmable payment rail. The trigger is the rise of autonomous AI agents. An agent can reason, browse, and act on its own, but traditional payments assume a human first sets up an account, an API key, or a billing relationship. x402 closes that gap: the agent pays per request, on demand, with no pre-registration.

Where it is now: x402 is an open, platform-agnostic standard. Any client or agent framework can participate as long as it understands the HTTP 402 response (LangChain, CrewAI, AutoGen, Strands, or a plain HTTP client). Governance has moved to a vendor-neutral x402 Foundation under the Linux Foundation to standardize internet-native payments for AI agents.

Enter image description here

Getting started with AI traffic monetization

Prerequisites

An AWS WAF protection pack (Web ACL) associated with an Amazon CloudFront distribution.
A USDC wallet address (Base and/or Solana) to receive payments.
AWS WAF Bot Control enabled to classify AI bot traffic by identity.

Step 1: Enable AWS WAF Bot Control

Add the Bot Control managed rule group to your Web ACL so AWS WAF can identify and label bot traffic. Targeted inspection exposes the richest labels (specific crawler names and verified/unverified status).

Step 2: Configure monetization (MonetizationConfig)

In the AWS WAF console, configure the payment settings on your protection pack: set CurrencyMode (TEST to validate first, or REAL for production), choose your chain(s), enter your recipient wallet address, and set the base price per request. Settlement is provided by Coinbase Developer Platform's x402 facilitator.

Step 3: Add a Monetize rule

Create a rule with the Monetize action and a match statement that targets the traffic you want to charge. For example, the Bot Control label awswaf:managed:aws:bot-control:bot:category:ai, a specific path, or other request characteristics. Configure rights-based multipliers here to differentiate pricing by identity or intent.

Step 4: Send a test request and read the 402 challenge

With CurrencyMode: TEST, any request matching your Monetize rule gets a 402 with the x402 pricing manifest. You can see it with a plain curl. Send an AI-bot User-Agent and decode the payment-required header:

URL="https://<your-distribution>.cloudfront.net/<monetized-path>"

# AI crawler -> HTTP 402 Payment Required
curl -si -A "GPTBot/1.2" "$URL" | head -1

# Decode the x402 challenge (strip the CR before base64-decoding):
curl -si -A "GPTBot/1.2" "$URL" \
  | awk 'tolower($1)=="payment-required:"{print $2}' | tr -d '\r' \
  | python3 -c "import sys,base64,json;r=sys.stdin.read().strip();r+='='*(-len(r)%4);print(json.dumps(json.loads(base64.b64decode(r)),indent=2))"

The decoded challenge shows exactly what the agent must pay (this is real output from a test-mode Web ACL on Base Sepolia):

{
  "accepts": [{
    "amount": "1000",                                       // 0.001 USDC (6 decimals)
    "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",  // USDC on Base Sepolia
    "network": "eip155:84532",                              // 84532 = Base Sepolia chain ID
    "payTo": "0x...your recipient wallet...",
    "scheme": "exact"
  }],
  "error": "PAYMENT-SIGNATURE header is required",           // why it's a 402
  "x402Version": 2
}

A normal browser User-Agent should not get a 402, since it isn't labeled as a bot. This is a quick way to confirm your Monetize rule is scoped correctly.

Step 5: Complete the pay → 200 loop with an x402 client

A 402 is only half the flow. To confirm the loop end-to-end, use an x402-capable client to sign the payment and resubmit. You have two options: the AWS Agent Toolkit (the amazon-bedrock skill via Bedrock AgentCore Payments), or a minimal client built on the open-source x402 library plus eth-account. The client fetches the resource, receives the 402, signs an EIP-3009 authorization, and retries with a PAYMENT-SIGNATURE header. On success, WAF returns 200 with the content and a PAYMENT-RESPONSE header containing the on-chain transaction hash. Verify that hash on a block explorer and confirm the USDC arrived in your wallet.

Step 6: Go live and monitor

When satisfied, update CurrencyMode to REAL and configure production networks (BASE, SOLANA). Review the AI traffic analysis dashboard and revenue analytics to monitor earnings.

Tips from hands-on testing

Two things that are easy to trip over, learned from validating this end-to-end in test mode:

The payer wallet must differ from the recipient wallet. If the agent signs a payment from the same address you configured as payTo, the facilitator rejects it with self_send_not_allowed. Use a separate wallet for the paying agent.
WAF settles only when the origin returns a successful response. WAF verifies the payment before fetching the origin, but the on-chain settlement happens after the origin responds successfully (2xx), so no funds move if the origin errors. If a valid payment ends in a non-2xx, the problem is on the origin side, not the payment. Because settlement is tied to a successful response, publishers only ever charge for content they actually deliver.

Conclusion

AWS WAF AI traffic monetization turns the long-dormant HTTP 402 status code into a practical revenue option for content and API providers facing AI crawlers and agents. Rather than choosing only between allow and block, you can charge per request at the CloudFront edge. Bot Control classifies and labels the traffic, a Monetize rule returns the x402 payment challenge, and the payment is verified and settled in USDC through the Coinbase facilitator, all without writing your own edge logic. Start in test mode on Base Sepolia to validate pricing and the end-to-end flow with faucet funds, review the AI traffic analysis dashboard to understand your bot traffic before setting prices, and switch CurrencyMode to REAL when you are ready to go live.