Use the Universal HTTP Gateway when no maintained native adapter fits the application. It is a fixed-origin reverse proxy: public routes are forwarded, protected routes receive an x402 v2 challenge, and a protected request reaches the origin only after Access402 confirms settlement or a valid reusable grant.

Node runtime

npx -y @access402/cli gateway

The Node entry point reads access402.yaml and .env.access402. Add the command to the application's process definition and keep the origin on a separate fixed URL.

Cloudflare Workers

The same one-prompt CLI detects Wrangler and selects the Worker-native runtime automatically. Wrangler can load access402.yaml as a text module, keeping the YAML file as the repository source of truth:

npm install @access402/cloudflare yaml

import { createCloudflareGateway } from '@access402/cloudflare'
import { parse } from 'yaml'
import access402Source from '../access402.yaml'

const access402Config = parse(access402Source)

export default createCloudflareGateway({
  config: access402Config,
  originBinding: 'ORIGIN',
})

Add a Wrangler module rule and service binding:

{
  "rules": [
    { "type": "Text", "globs": ["**/*.yaml"], "fallthrough": true }
  ],
  "services": [
    { "binding": "ORIGIN", "service": "your-origin-worker" }
  ],
  "kv_namespaces": [
    { "binding": "ACCESS402_CONFIG_CACHE", "id": "your-kv-namespace-id" }
  ],
  "queues": {
    "producers": [
      { "binding": "ACCESS402_EVENTS_QUEUE", "queue": "access402-events" }
    ],
    "consumers": [
      { "queue": "access402-events" }
    ]
  },
  "triggers": {
    "crons": ["*/5 * * * *"]
  ]
}

Run npx @access402/cli sync before deployment, then run doctor against the deployed Worker to validate the challenge and warm its signed policy cache. The scheduled handler refreshes policy in KV; request handlers use an in-isolate L1 cache and KV as L2. A genuinely empty or expired cache performs one signed configuration read and fails closed if it cannot refresh—it never registers endpoints from customer traffic. Ordinary warm per-request payments make only the authoritative settlement call. Bootstrap traffic and reusable grants retain the lifecycle check.

Cloudflare service bindings call the private origin Worker directly without sending the request over the public Internet. If your origin is not another Worker, configure one fixed HTTPS origin in access402.yaml and prevent direct public access through your hosting or network controls.

Worker bindings

Store these as Worker secrets or server-only bindings:

ACCESS402_INSTALLATION_ID
ACCESS402_API_KEY
ACCESS402_MODE
ACCESS402_ORIGIN_AUTH_SECRET

Optional bindings include ACCESS402_API_BASE_URL, ACCESS402_CONFIG_TTL_SECONDS, ACCESS402_CONFIG_HARD_TTL_SECONDS, and ACCESS402_MAX_BODY_BYTES. Never use frontend-prefixed variables or place installation credentials in [vars] committed to the repository.

Protect the origin

The Gateway adds a short-lived HMAC token in X-Access402-Origin-Authorization. The origin must validate that token before Live and must not remain reachable through an alternate public hostname. Node origins can import verifyOriginAuthorization from @access402/node; the previous @access402/cli/gateway export remains available for compatibility.

Prefer a private Cloudflare service binding where possible. Otherwise use a firewall, private network, authenticated ingress, or equivalent control in addition to the signed origin token.

Runtime behavior

Both Gateway runtimes validate the signed Access402 configuration, exact resource, network, asset, amount, and receiving wallet. They reject ambiguous paths, do not follow control-plane redirects, keep protected responses private, no-store, and fail closed when configuration or settlement is unavailable.

The Worker-native runtime reads secrets from env, uses Web APIs instead of Node streams, safely binds fetch, and exposes a non-secret X-Access402-Error code for deployment diagnostics.

Automatic discovery

Routes marked discovery: true are served automatically in Live mode at:

/.well-known/ard.json for Agentic Resource Discovery
/openapi.json for OpenAPI 3.1 operation and schema metadata
/llms.txt for concise agent-readable guidance

The documents are built from repository policy plus the cached signed configuration. Disabled, pending, and non-discoverable resources are omitted. The Gateway advertises all three through Link headers on the root response and HTTP 402 challenges. Serving these documents does not add a Supabase or Access402 call to ordinary paid requests.