Hosted Gateway — zero code

The hosted Gateway is the fastest way to charge AI agents for an API you already run. AiFinPay proxies agent traffic to your upstream and handles the whole payment conversation — the HTTP 402 challenge, the on-chain settlement check, metering and receipts. Your API stays exactly as it is.

AI agent ──(pays, AIFP-1)──▶ gateway.aifinpay.io/{your-slug}/... ──▶ your API
                                        │
                          policy check · metering · receipts

Zero code

Configure everything in the dashboard: a slug and your upstream URL. No SDK in your stack, no process to host.

Non-custodial

Every batch settles on-chain straight to a wallet you own. AiFinPay never holds your funds — there is no withdraw step.

What you need

Item	Why
An email address	Dashboard sign-in is a magic link — no password.
A `0x` EVM address you control	Where revenue settles. One address receives on all supported EVM networks.
Your API’s base URL	The upstream the gateway forwards paid requests to. Must be public HTTPS.
(Recommended) Cloudflare or nginx in front of your API	One rule locks your origin so agents can’t skip the gateway.

Set it up

Go to dash.aifinpay.io, enter your email and follow the magic link. Create a service: pick a name and paste your payout wallet (0x…). That wallet is where every settlement lands — AiFinPay never custodies it.

Configure the Gateway

Open the Gateway page. Choose a slug (lowercase, e.g. acme-search) and enter your upstream base URL (e.g. https://api.acme.dev). Save.Your paid endpoint is live immediately:

https://gateway.aifinpay.io/acme-search/<any-path>

Requests to it are challenged with HTTP 402 until the agent pays; paid requests are forwarded to https://api.acme.dev/<any-path>.

Lock your origin

Right now agents could still call api.acme.dev directly and skip the paywall — so nothing actually gets paid. Closing that hole takes one rule at your edge: see Lock your origin below for the Cloudflare WAF and nginx rules. Do not skip this step; without it the gateway is a suggestion rather than a paywall.

Watch the money arrive

That’s the whole setup. From here the dashboard does the reporting:

Transactions — every settled payment with its on-chain receipt.
Payout — your wallet, and every batch that settled to it.
Traffic Heatmap / Overview — which routes agents actually call.

A gated route with traffic but no payments yet shows as “Paywall on — no payments yet” — that’s agents receiving 402 challenges before the first one settles, not a misconfiguration.

Lock your origin

Without this the gateway can be bypassed: an agent that calls api.acme.dev directly gets your data for free. This rule is what makes the paywall real. Saving the Gateway config generated an origin secret (shown once — store it like a password). The gateway injects it into every forwarded request:

AIFP-Proxy-Auth: <your-origin-secret>

What you do with that header depends on what is behind the origin, and getting this wrong is the one mistake here that takes a site offline.

If the origin is an API

Nothing but agents calls it, so reject everything without the header. Cloudflare — WAF custom rule, zero code:

(http.host eq "api.acme.dev" and not
  any(http.request.headers["aifp-proxy-auth"][*] eq "<your-origin-secret>"))
→ Block

nginx:

if ($http_aifp_proxy_auth != "<your-origin-secret>") { return 403; }

If the origin serves pages to people

Do not use the rule above on a site with human readers. Browsers reach your site directly, not through the gateway, so they do not carry the header — and neither does Googlebot. “Block everything without the secret” means every reader gets a 403 and the site drops out of search.Invert it: allow everyone by default, and block only AI crawlers that arrive without the secret.

Cloudflare:

(cf.verified_bot_category eq "AI Crawler"
 or any(lower(http.user_agent) contains
   {"gptbot" "claudebot" "perplexitybot" "ccbot" "bytespider" "google-extended"}))
and not any(http.request.headers["aifp-proxy-auth"][*] eq "<your-origin-secret>")
→ Block

An AI crawler that pays through the gateway arrives with the header and is let through; one that does not, is not. Human readers and search indexing are untouched. Keep any genuinely private paths — /api/*, /login, admin panels — closed by their own rules as before. This rule is about crawlers, not authentication.

With the inverted rule, Verify lock in the dashboard will report the origin as open. That is correct and not a misconfiguration: the check requests your origin without the secret and expects to be refused, but it does not identify itself as an AI crawler, so your rule deliberately lets it through. Verify lock is meaningful for API origins; for a site with human traffic, test instead with a crawler user-agent.

Rotating is safe: Rotate secret in the dashboard keeps the previous secret valid for a short grace window, so there is no downtime. Then press Verify lock — AiFinPay calls your upstream without the secret and expects a 401/403. A green verdict means the only way in is through the paywall.

How agents pay you

Agents using the AiFinPay SDK (Node, Python) or the MCP server handle the whole flow automatically — one agent.pay(url) call resolves the 402, pays on-chain from the agent’s own wallet and retries. To be discovered by agents you don’t already know, list your service on the Marketplace (dashboard → Marketplace → publish; a short review keeps spam out of the public catalog).

Gateway vs. SDK middleware

	Hosted Gateway (this page)	SDK middleware
Code changes	None	A middleware in your backend
Traffic path	Through `gateway.aifinpay.io`	Direct to your domain
Receipt verification	Done by the gateway	Local, via JWKS — no network call
Best for	Getting live in minutes	Full control, no proxy in the path

Both settle the same way: on-chain, straight to your wallet.

Get started

Pay for services

Charge for your API

Reference

Hosted Gateway — zero code

Zero code

Non-custodial

What you need

Set it up

Lock your origin

If the origin is an API

If the origin serves pages to people

How agents pay you

Gateway vs. SDK middleware

Zero code

Non-custodial

​What you need

​Set it up

​Lock your origin

​If the origin is an API

​If the origin serves pages to people

​How agents pay you

​Gateway vs. SDK middleware

What you need

Set it up

Lock your origin

If the origin is an API

If the origin serves pages to people

How agents pay you

Gateway vs. SDK middleware