Count the requests. A priced page costs two round trips to the origin: the one that comes back 402 carrying price, destination wallet and expected network, and the one that carries the transaction hash in `X-Payment-Signature` [4][6][2]. Between them your client talks to a facilitator, which does the chain work and hands back the hash [5]. After them the server calls the facilitator again to verify before it serves bytes [6]. A bot-blocking workaround was never written for this loop.
Settlement, not the 402, is the expensive failure. The author classifies every failure reason in the x402 spec as terminal, retryable, or needs reconciling, and `settlement_pending` is never retried blind: the chain is asked what became of the transaction first, because a blind retry is how one fetch gets paid for twice [18]. Concurrent workers racing the same URL collapse onto a single request through `singleflight`, so the losers wait and share the result instead of each buying it [21]. Both of those are idempotency problems wearing HTTP clothes.
The defaults are where the craft shows. `client.Config.Authorize` has no default value, and the stated reason is that a client with no policy would pay whatever a server asked, silently and expensively [13][14]. Callers who genuinely want no ceiling pass `client.AllowAnyPayment`, so the decision is in the source tree rather than implied by an unset field [13]. The per-payment cap and the cumulative total are claimed under one lock before signing, so two workers cannot both be told there is room for the last payment [16]. When the crawl exhausts the budget, it simply reports which URLs it could not reach [17]. `--dry-run` prices a crawl with the caps still applied, which answers what the budget would buy rather than what everything would cost [19]. PDFs stream to disk under a size cap with filenames hashed from the URL, so a server cannot pick what lands on your filesystem [20]. The log redactor inspects values, not field names, so a private key logged under any name still gets stripped [22]. A key logged under `debug_extra` is still a key.
On the framing: the post says x402 "absolves the internet's original sin" and is "foundational internet infrastructure," not a crypto side project [8]. Linux Foundation stewardship and a backer list that includes Cloudflare, Coinbase, AWS, Google, Stripe and Visa tell you about governance, not deployment [7]. What tells you deployment is whether the servers you crawl emit priced 402s, and this build was exercised against Base Sepolia through a free public test facilitator run by an independent project [11].
The traffic number needs the same treatment. The post reports 57% of internet traffic as AI and scraping bots, up from 20% in 2021, and credits Cloudflare's article [1][2][26]. That is roughly 2.85 times the 2021 share [1]. For it to describe your logs, your properties would have to sit behind similar measurement and attract a similar crawler mix; a niche origin with no AI interest sees a different ratio no matter what the aggregate says. HTTP 402 has been in the spec since 1991, which is a long time for a status code to have no client implementations [3].
One caveat on sourcing: all of this comes from a single post by the crawler's author, and the copy supplied cuts off mid-sentence exactly where he begins contrasting his wallet-native build with Cloudflare's own gateway [25]. That contrast is the part I would most like to read.
