A beggar holding a 'GOT HACKED LOST ALL MY CRYPTO' sign next to his dog. Cartoon: Cybercrime Magazine (cybersecurityventures.com).

A Paywall That Locks Nothing

The Pay page takes crypto tips from humans and 402 payments from AI agents — and unlocks absolutely nothing. It is a working demo of honest machine payments, with every limitation documented.

Most payment pages sell you something. This one sells nothing, on purpose. For humans it is a simple tip jar: QR codes and copy buttons for two dollar-pegged cryptocurrencies. For AI agents it is something stranger — a working implementation of the 402 “Payment Required” web standard: the agent asks, gets told the price, pays on the blockchain, retries with proof, and receives a signed receipt. For content that was never locked in the first place.

The details are where the craft lives. Amounts are stored as exact integer strings, never floats. Receipts are tamper-evident, sealed with a server-side key over canonically ordered data. The QR codes were generated once and then independently decoded to prove they scan to the right address — and the page lists every address in plain text, because a payment page that needs JavaScript to show its addresses has failed its only job. Most honestly: on-chain verification is openly deferred. The docs record exactly which gateway calls fail from Cloudflare's network, so the checker endpoint returns “not implemented” instead of pretending.

Students: protocol design is a learnable craft — canonical forms, fail-closed validators, receipts — and this is a complete specimen. Hiring managers: fifty-two automated checks plus a written list of what was deliberately left out is what shipping with integrity looks like.

No comments yet