What are machine payments and HTTP 402?
HTTP 402 Payment Required is the response a server returns when the thing an agent asked for has a price. The agent's operator pays that price over a payment rail, repeats the request with proof of payment, and receives the content. A machine payment is that transaction: no human in the loop, one fetch, one price, one record.
The code has been reserved in the HTTP specification since the 1990s. AI retrieval gave it a market: visitors that want the content, can pay programmatically, and can be identified at the door.
The 402 handshake
- An AI agent requests a page. The server identifies it as an AI agent by user agent, published IP range or request signature.
- Instead of the page, the server returns 402 with the site's rate for that content and the terms of use.
- The agent's operator pays per fetch through the rail and re-requests.
- The server serves the content, usually in a bot-ready format such as Markdown or slim HTML, and logs the transaction: who fetched what, when, at what price.
Humans never see any of this, and Googlebot and Bingbot are excluded by design.
What a rate card looks like
A rate card is the set of prices and rules the site owner sets, a table rather than a single number.
| Rule dimension | What it distinguishes |
|---|---|
| Agent class | Training crawlers, retrieval (RAG) bots, AI search indexers |
| Named agent | A specific operator, by verified user agent |
| Path | Sections of the site (archive, breaking news, product pages, support) |
| Freshness | Content published in the last day or week versus the back catalog |
| Response | Serve free, charge a per-fetch rate, or refuse |
A common shape: indexers read free because they send traffic, retrieval bots pay per fetch because they consume the answer, training crawlers pay a higher rate or are refused. Rates vary across the network by orders of magnitude depending on content type and freshness, and the owner changes them without touching the site.
Why RAG payments matter more than training deals
A training deal is a one-time sale of an archive. Retrieval is recurring. Every time an assistant answers a question, it fetches pages into a context window, and it cannot cache the result, because the next question needs the current page. Agents do not get tired. Across our network of 10,000+ sites we observe 200M+ AI bot fetches a day, and in H1 2026 2.6B+ AI bots were directed to the TollBit Bot Paywall (State of the Bots H1 2026).
The referral side is shrinking against the read side. In the EU the scrape-to-referral ratio went from 150:1 in Q1 2026 to 227:1 in Q2. The event that scales with AI usage is the fetch, and 402 prices the fetch.
From content to everything else
Content is the first market because the goods are digital and the buyer is a machine. The mechanism extends. A personal assistant that books a table, reserves a product or pulls a quote on a user's behalf is a machine making a request a business may want to price or at least authenticate. The pressure is already visible: in September 2026 Resy deactivated accounts whose personal assistant was hitting the site at about 200 requests an hour, and Meta launched Muse, a personal assistant, the same month. 402 gives a business a third option between serving every agent free and blocking all of them.
Where TollBit fits
TollBit operates a bot paywall across 10,000+ sites that returns 402 with the owner's rate card, collects payment from AI operators, serves the content in a bot-ready format and logs every transaction into the same analytics that show all other AI reads. Licensed RAG is the developer side of the same rail: a search, a price, a fetch, with the licence attached to the response. The bot paywall works on top of Akamai, Cloudflare, Fastly, CloudFront, DataDome, Imperva and HUMAN, which identify the bot while TollBit decides what it gets.
Frequently asked questions
Is HTTP 402 an official standard? Yes. It is defined in the HTTP specification and has been reserved for "Payment Required" since HTTP/1.1. What was missing was a payment rail and a buyer, and AI retrieval supplied both.
Who actually pays, the AI company or the end user? The operator of the agent pays per fetch, and how it recovers that cost is its own decision. Some operators pass usage costs to their customers. Either way the site owner is paid at the fetch, not at some later click.
Does charging agents make a site disappear from AI answers? Blocking does. Charging does not, for agents whose operators pay. The paying agent reads the current page in a clean format, which is a better input to an answer than a scraped copy, and the owner sees exactly what was read.