The Request Is the Transaction: Why Payments People Should Be Watching Cloudflare

Earlier this week I spent time at a Mastercard forum for acquirers and PSPs. Most of the sessions were about AI. Agentic commerce, agent tokens, authentication for bots that shop on our behalf. It was a good event, and the schemes are clearly taking this seriously.

But I walked out with a nagging thought. Almost every conversation treated the AI agent as a new kind of cardholder. How do we give it a token? How do we authenticate it? How do we let it check out?

Hardly anyone asked the question that I think matters more: who sits between the agent and the merchant?

Because in every era of online commerce I've worked in, whoever owned that position ended up owning the payment.

I've watched this happen three times

I started selling online before the web browser existed, through Usenet newsgroups in the early 90s. There was no checkout. Payment was a cheque in the mail, and trust was personal.

Then came the browser, and later the marketplace. In 2008, I was a founding third-party seller when Amazon UK opened its apparel category, and over the following years I supplied across 14 Amazon businesses globally with a print-on-demand and personalisation business. Amazon owned the buyer, so Amazon owned the payment. As a seller, you lived on Amazon's terms.

Then came the platforms. Shopify, the agencies, the plugins. I've been involved in thousands of websites and have spent years onboarding platforms and merchants in payments. The platform owned the merchant, so the platform embedded the payment.

Each time, the payment followed the gatekeeper.

Now the buyer is becoming software. So the question is, who's the gatekeeper this time?

Amazon owned the destination. Cloudflare owns the road.

In the last era, Amazon won by being the place buyers went. Its cloud business, AWS, became the infrastructure everyone else rented, but AWS itself stayed out of commerce. You rented capacity in a region, and what happened in your checkout was your business.

Cloudflare is a different kind of company. It doesn't host your store. It sits in front of it. By its own numbers, around 20% of the internet runs on Cloudflare, and every request from a person, a bot or an AI agent passes through its network before it reaches the merchant.

For most of the last decade, that mattered for speed and security, not for payments. When a human clicked “buy”, the card schemes owned that moment and the network just carried the page.

Agents change that. When software is the buyer, the request and the purchase start to merge into one thing.

Cloudflare knows it. Its latest investor presentation describes every agent request as “a metered event”, running from discovery through to settlement, and positions Cloudflare as the “control plane for the Agentic Internet”. One slide compares the largest card network's roughly 900 million transactions a day with Cloudflare's 30 trillion-plus daily requests.

Now, as payments people we know that's apples and oranges. A card transaction is authorised, cleared and settled. A Cloudflare “transaction” is an HTTP request or a DNS lookup. But I don't think the slide is claiming Cloudflare is bigger than Visa or Mastercard. The real message is that every one of those requests could carry a price.

That's the shift. The request becomes the transaction.

Cloudflare has already built most of a network stack

What surprised me when I looked into it is how much is already in place. Three layers stand out.

Identity. Cloudflare's Web Bot Auth lets a merchant verify that an agent is who it says it is. It underpins Visa's Trusted Agent Protocol, Mastercard has incorporated it into Agent Pay, and American Express has signed on too. In other words, the schemes are already relying on Cloudflare to vouch for agents.

Asking for payment. Cloudflare and Coinbase set up the x402 Foundation to revive an old web status code, HTTP 402 “Payment Required”. A website can now reply to an agent with a price instead of a page, and the agent can pay and continue in the same exchange. No signup, no API key, no stored card. The payment is the credential. Cloudflare's Monetization Gateway, announced in July, lets any site on its network charge agents per request this way, and AWS has added x402 support to its own agent platform.

Settlement. Cloudflare has introduced wallets for agents, with spending limits and escalation when an agent goes over budget, and has announced a US dollar stablecoin, NET Dollar, aimed at instant machine-to-machine payments.

Identity, payment messaging and settlement. Individually they look like developer tools. Together, they're the outline of a payment network.

Nobody is talking about agents taking payments

Most of the agentic commerce conversation is about the buying agent: my assistant books my flight, reorders my groceries, finds the cheapest headphones.

But merchants will run agents too. Agents that quote, negotiate, accept, fulfil and refund. When the buyer is an agent and the seller is an agent, checkout as we know it disappears. There's no cart, no payment page and no hosted fields. The payment becomes a handshake between two pieces of software, and it happens at the network edge, not at the gateway.

I've been building and testing such scenarios and sometimes it's hard to get your head around, but it's real, and it works!

For acquirers and PSPs, that's the part that should keep us up at night. A hosted checkout page has nowhere to render or no need to be rendered. It isn't that a new network replaces the schemes. It's that the decision about how a payment gets routed moves one hop earlier, from the gateway to the edge.

One of my projects earlier in my career was express aka accelerated checkout and this is clearly a further iteration. I've spent a decade working on funnel stages and payment posturing in e-Commerce, but this is much more extreme.

Why Cloudflare might not win this

I've been in payments long enough to be suspicious of anything that claims to rewrite the rules, so here's the other side. And there's a fair bit.

Being in the path isn't the same as owning the customer. Telcos spent two decades saying every request passed through their network. Most ended up as utilities while Apple, Google and payments companies took a margin. Sitting in the path of traffic gives you leverage. It doesn't automatically give you the commercial relationship.

The platforms won't sit still. Google (along with Shopify) published Universal Commerce Protocol (UCP), OpenAI and Stripe have published their own Agentic Commerce Protocol (ACP), and Stripe has launched its own Machine Payments Protocol. If an AI agent buys from a Shopify merchant, both sides have every reason to agree a direct rail and treat the network as plumbing.

Merchants can route around a tollbooth. Leaving Amazon means losing your shoppers. Moving CDN is a much smaller job, although anyone who has migrated security rules and edge code knows it's not just a DNS change. If the edge starts taking a cut, large merchants will go multi-CDN. But, Cloudflare knows this.

The volume isn't there yet. x402 transactions are mostly protocol signalling or sub-cent micropayments. One analytics firm, Artemis, estimates around half are artificial. We're about to see this change very quickly.

The hard parts of a network are missing. x402 handles the quote and the settlement. It doesn't handle disputes, chargebacks, liability shift or issuer risk. Those are the reasons card networks exist, and they took decades to build. Account to account payments have the same challenges so, not a show stopper.

Consumers don't trust it. One survey this year found only 14% of consumers would let AI make a purchase without checking it first. Nothing a toe in the water couldn't solve for. I'd be more than happy for an agent to have sorted out Radiohead tickets instead of the hours spent in the virtual queue.

Finance teams need to reconcile it. Settling consumer purchases in stablecoins in Australia runs straight into licensing and AML obligations. And until a CFO can reconcile thousands of stablecoin micropayments in NetSuite without a compliance headache, this stays mostly in crypto-native and developer circles. Same as PayTo/NPP.

So where does this land?

My view is that we're heading for a split, not a takeover.

High-value agentic purchases stay on cards. The flight, the headphones, the weekly shop. Visa and Mastercard's agent programmes will carry these, with liability and disputes intact. Cloudflare's role is the trust layer, verifying the agent before the scheme ever sees the transaction.

Machine-to-machine micropayments move to edge-native rails. Paying for data, content, APIs and compute, a fraction of a cent at a time. Cards were never built for this, and interchange makes no sense at that scale. Whoever sits in the request path has the best shot at this, and Cloudflare is already there.

Even if Cloudflare never becomes the next scheme, the direction is clear. For the last decade, we optimised payments for people: one-click checkout, wallets, slick hosted fields. For the next decade, we'll have to optimise for machines: fast APIs, cryptographic agent identity and disputes that software can handle.

For acquirers, gateways and PSPs, I'd be thinking about three things now:

• Plug into the trust layer early. If agent identity is verified at the edge, your fraud and risk tools need to consume that signal, not ignore it.
• Make your merchants agent-ready. An agent can't fill in hosted payment fields. Payment endpoints that software can quote, accept and settle against will become a product category of their own.
• Treat the edge as a channel, not a vendor. In the last era, the smart payments players treated Shopify, WooCommerce and the marketplaces as distribution. In this era, the network edge is distribution.

Amazon taught a generation of sellers that whoever owns the buyer owns the payment. The agentic era is teaching a new lesson: whoever owns the request may end up owning the transaction.

The room at the scheme event was right that AI will change payments. But the schemes are adapting the card for a bot, while the infrastructure players are building payments into the internet itself. I think the biggest change will come from the road the agent travels on.