> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aifinpay.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Hosted Gateway — zero code

> Put a payment gate in front of your existing API in about five minutes, entirely from the dashboard. No SDK, no bridge to host, no code changes.

The hosted Gateway is the fastest way to charge AI agents for an API you
already run. AiFinPay proxies agent traffic to your upstream and handles the
whole payment conversation — the `HTTP 402` challenge, the on-chain
settlement check, metering and receipts. Your API stays exactly as it is.

```text theme={null}
AI agent ──(pays, AIFP-1)──▶ gateway.aifinpay.io/{your-slug}/... ──▶ your API
                                        │
                          policy check · metering · receipts
```

<CardGroup cols={2}>
  <Card title="Zero code" icon="wand-magic-sparkles">
    Configure everything in the dashboard: a slug and your upstream URL.
    No SDK in your stack, no process to host.
  </Card>

  <Card title="Non-custodial" icon="lock">
    Every batch settles on-chain straight to a wallet you own. AiFinPay
    never holds your funds — there is no withdraw step.
  </Card>
</CardGroup>

## What you need

| Item                                                   | Why                                                                        |
| ------------------------------------------------------ | -------------------------------------------------------------------------- |
| An email address                                       | Dashboard sign-in is a magic link — no password.                           |
| A `0x` EVM address you control                         | Where revenue settles. One address receives on all supported EVM networks. |
| Your API's base URL                                    | The upstream the gateway forwards paid requests to. Must be public HTTPS.  |
| (Recommended) Cloudflare or nginx in front of your API | One rule locks your origin so agents can't skip the gateway.               |

## Set it up

<Steps>
  <Step title="Sign in and create a service">
    Go to [dash.aifinpay.io](https://dash.aifinpay.io), enter your email and
    follow the magic link. Create a service: pick a name and paste your
    payout wallet (`0x…`). That wallet is where every settlement lands —
    AiFinPay never custodies it.
  </Step>

  <Step title="Configure the Gateway">
    Open the **Gateway** page. Choose a slug (lowercase, e.g. `acme-search`)
    and enter your upstream base URL (e.g. `https://api.acme.dev`). Save.

    Your paid endpoint is live immediately:

    ```text theme={null}
    https://gateway.aifinpay.io/acme-search/<any-path>
    ```

    Requests to it are challenged with `HTTP 402` until the agent pays;
    paid requests are forwarded to `https://api.acme.dev/<any-path>`.
  </Step>

  <Step title="Lock your origin">
    Right now agents could still call `api.acme.dev` directly and skip the
    paywall — so nothing actually gets paid. Closing that hole takes one rule
    at your edge: see [Lock your origin](#lock-your-origin) below for the
    Cloudflare WAF and nginx rules. Do not skip this step; without it the
    gateway is a suggestion rather than a paywall.
  </Step>

  <Step title="Watch the money arrive">
    That's the whole setup. From here the dashboard does the reporting:

    * **Transactions** — every settled payment with its on-chain receipt.
    * **Payout** — your wallet, and every batch that settled to it.
    * **Traffic Heatmap / Overview** — which routes agents actually call.

    A gated route with traffic but no payments yet shows as
    *"Paywall on — no payments yet"* — that's agents receiving 402
    challenges before the first one settles, not a misconfiguration.
  </Step>
</Steps>

## Lock your origin

Without this the gateway can be bypassed: an agent that calls
`api.acme.dev` directly gets your data for free. This rule is what makes the
paywall real.

Saving the Gateway config generated an **origin secret** (shown once — store it
like a password). The gateway injects it into every forwarded request:

```text theme={null}
AIFP-Proxy-Auth: <your-origin-secret>
```

What you do with that header depends on what is behind the origin, and getting
this wrong is the one mistake here that takes a site offline.

### If the origin is an API

Nothing but agents calls it, so reject everything without the header.

**Cloudflare** — WAF custom rule, zero code:

```text theme={null}
(http.host eq "api.acme.dev" and not
  any(http.request.headers["aifp-proxy-auth"][*] eq "<your-origin-secret>"))
→ Block
```

**nginx**:

```nginx theme={null}
if ($http_aifp_proxy_auth != "<your-origin-secret>") { return 403; }
```

### If the origin serves pages to people

<Warning>
  **Do not use the rule above on a site with human readers.** Browsers reach your
  site directly, not through the gateway, so they do not carry the header — and
  neither does Googlebot. "Block everything without the secret" means every
  reader gets a 403 and the site drops out of search.

  Invert it: allow everyone by default, and block only AI crawlers that arrive
  without the secret.
</Warning>

**Cloudflare**:

```text theme={null}
(cf.verified_bot_category eq "AI Crawler"
 or any(lower(http.user_agent) contains
   {"gptbot" "claudebot" "perplexitybot" "ccbot" "bytespider" "google-extended"}))
and not any(http.request.headers["aifp-proxy-auth"][*] eq "<your-origin-secret>")
→ Block
```

An AI crawler that pays through the gateway arrives *with* the header and is let
through; one that does not, is not. Human readers and search indexing are
untouched.

Keep any genuinely private paths — `/api/*`, `/login`, admin panels — closed by
their own rules as before. This rule is about crawlers, not authentication.

<Note>
  With the inverted rule, **Verify lock** in the dashboard will report the origin
  as open. That is correct and not a misconfiguration: the check requests your
  origin without the secret and expects to be refused, but it does not identify
  itself as an AI crawler, so your rule deliberately lets it through. Verify lock
  is meaningful for API origins; for a site with human traffic, test instead with
  a crawler user-agent.
</Note>

Rotating is safe: **Rotate secret** in the dashboard keeps the previous secret
valid for a short grace window, so there is no downtime. Then press **Verify
lock** — AiFinPay calls your upstream *without* the secret and expects a
`401`/`403`. A green verdict means the only way in is through the paywall.

## How agents pay you

Agents using the AiFinPay SDK ([Node](/pay/node), [Python](/pay/python)) or
the [MCP server](/pay/mcp) handle the whole flow automatically — one
`agent.pay(url)` call resolves the 402, pays on-chain from the agent's own
wallet and retries. To be discovered by agents you don't already know, list
your service on the **Marketplace** (dashboard → Marketplace → publish; a
short review keeps spam out of the public catalog).

## Gateway vs. SDK middleware

|                      | Hosted Gateway (this page)    | [SDK middleware](/charge/dashboard) |
| -------------------- | ----------------------------- | ----------------------------------- |
| Code changes         | None                          | A middleware in your backend        |
| Traffic path         | Through `gateway.aifinpay.io` | Direct to your domain               |
| Receipt verification | Done by the gateway           | Local, via JWKS — no network call   |
| Best for             | Getting live in minutes       | Full control, no proxy in the path  |

Both settle the same way: on-chain, straight to your wallet.