Edge Crypto Paywalls & Webhooks on Cloudflare Workers

Run sub-millisecond HTTP 402 AI/API paywalls, offline ES256 JWKS license verification, and WebCrypto HMAC-SHA256 webhook handlers across 300+ Cloudflare Edge locations.

Generate Worker HTTP 402 Code GitHub Source & v1.0.0 Developer Docs

Integration Details

Version 1.0.0
Last Updated 2026-11-12
Compatibility Cloudflare Workers · Hono · Pages · D1 & KV
Open-Source Repo v1.0.0 Release
Generate Worker HTTP 402 Code

How to deploy XPayr on Cloudflare Workers in 5 minutes

  1. Store XPAYR_API_KEY and XPAYR_WEBHOOK_SECRET via npx wrangler secret put
  2. Return HTTP 402 + /.well-known/x402.json challenge headers on unauthenticated API/AI requests
  3. Verify Bearer ES256 JWT tokens at the edge using crypto.subtle and cached JWKS in Workers KV
  4. Persist idempotent webhook receipts in Cloudflare D1 or Durable Objects with zero cold starts

5-Step Zero-Dependency WebCrypto Edge Architecture

  1. Scaffold a TypeScript Cloudflare Worker (or Hono app) and bind KV/D1 namespaces in wrangler.toml.
  2. Use XPayr HTTP 402 Paywall Builder (/tools/http-402-paywall-builder) to generate edge middleware returning 402 Payment Required with a fresh XPayr session checkout_url.
  3. Cache https://xpayr.com/.well-known/jwks.json in Cloudflare KV (TTL 3600s) and verify client Authorization: Bearer <es256_jwt> tokens via WebCrypto crypto.subtle.verify("ECDSA", ...) in <1ms.
  4. In your /webhooks/xpayr Worker route, read const raw = await request.text() and verify X-XPayr-Signature via crypto.subtle.importKey("raw", ...) + crypto.subtle.verify("HMAC", ...).
  5. Write processed event_id rows into Cloudflare D1 (INSERT OR IGNORE INTO webhook_events ...) before crediting Durable Object or KV rate-limit quotas.

Why AI APIs & serverless engineers pair Cloudflare Workers with XPayr

<1ms offline ES256 JWKS verification

Gate LLM, scraping, RPC, and data APIs at the Cloudflare edge with zero database round-trips per request.

100% Web Standards (zero Node polyfills)

Uses native fetch() and WebCrypto SubtleCrypto — zero heavy native C++ binaries or cold-start bloat.

Monetize autonomous AI agents (HTTP 402)

Agents using @xpayr/mcp-server discover your 402 challenge, pay in USDC/NEAR/SOL, and retry automatically (/x402).

DDoS-resilient webhook ingestion

Absorb massive flash-sale webhook bursts at Cloudflare edge before queuing into Cloudflare Queues or D1.

Global Edge Monetization for AI Gateways, APIs & Hono Microservices

Cloudflare Workers, Hono, D1, and Workers AI let tiny engineering teams serve billions of global API requests without managing origin servers. Pairing Cloudflare Workers with XPayr HTTP 402 paywalls (/trust/http-402-paywall-verification) and 0.5% non-custodial USDC/USDT settlement turns any Worker endpoint into a self-monetizing global revenue engine.

FAQ

Cloudflare Workers Crypto & HTTP 402 FAQ

No! XPayr REST API v1, HMAC-SHA256 webhook verification, and ES256 JWKS license verification all work with 100% standard WinterCG fetch() and WebCrypto crypto.subtle APIs.

With /.well-known/jwks.json cached in Workers KV or Cache API, ECDSA P-256 signature verification takes under 0.5 milliseconds of CPU time at the edge.

Yes — Hono c.req.text() preserves exact UTF-8 webhook bytes for HMAC verification and pairs cleanly with Cloudflare D1 and Queues.

Open /tools/http-402-paywall-builder and select the Cloudflare Workers / Hono tab for a complete copy-paste Worker script.

Monetize APIs at the Cloudflare Edge for 0.5%.

Build HTTP 402 paywalls & WebCrypto webhooks with zero cold starts.

Get Started View All Plugins