TollGate

The payment gateway for the agentic web — enabling AI agents to discover, authorize, and pay for individual API calls automatically.

Comment

TollGate — Payments for the Agentic Web

Inspiration

The internet is evolving from a place where humans interact with applications into an ecosystem where AI agents independently discover services, execute tasks, and interact with APIs.

But there is a fundamental problem: how do autonomous agents pay for the services they use?

Most existing payment systems are designed around human-driven checkout experiences, subscriptions, and recurring billing. They are not designed for software agents that need to purchase individual API requests, consume metered services, and operate autonomously within predefined spending limits.

We built TollGate to address this gap: a payment infrastructure layer that enables machine-to-machine commerce through programmable, pay-per-use transactions.

What it does

TollGate is a payment gateway that enables AI agents and software applications to access paid APIs through a controlled authorization and metered payment system.

Instead of requiring subscriptions or manual checkout for every request, service providers can expose their APIs with transparent pricing, while agents can obtain authorization to consume services within predefined budgets.

Key capabilities include:

  • HTTP 402 Payment Required: APIs communicate payment requirements directly to clients when access requires payment.
  • PayPal Authorization: Users authorize a predefined spending budget through PayPal Sandbox.
  • Scoped Capabilities: Agents receive cryptographically signed permissions defining spending limits, permitted usage, and expiration.
  • Pay-per-Call Metering: Individual API requests are tracked against the authorized spending budget.
  • Cryptographic Receipts: Ed25519 signatures enable verification of capabilities and transaction records.
  • Authorization Revocation: Access can be revoked, with the corresponding PayPal authorization voided.

How we built it

We developed TollGate using a modular architecture built around an Express.js payment gateway, SQLite transaction ledger, and TypeScript agent SDK.

The gateway manages service discovery, payment challenges, authorization verification, usage metering, and cryptographic receipt generation.

We integrated the PayPal Developer Platform using PayPal Sandbox Orders API v2 to support buyer approval and payment authorization. This connects conventional payment infrastructure with an automated API consumption model.

For our demonstration, we configured a $5 spending budget, $0.05 per API call, a maximum of 100 calls, a rate limit of 60 requests per minute, and a one-hour authorization expiry.

We also developed the @tollgate/agent-sdk, which allows agents to discover service manifests, handle HTTP 402 responses, attach authorization capabilities and idempotency information, and verify signed receipts.

To demonstrate real-world applicability, we integrated public earthquake data from the USGS API, providing metered access to recent earthquake information and seven-day earthquake reports.

Challenges we faced

One of the biggest engineering challenges was designing a system that allows autonomous software to consume paid services without compromising security or financial control.

Some of the key challenges included:

  • Authorization and spending boundaries: Ensuring agents could only consume services within explicitly approved budgets and permissions.
  • Replay protection and idempotency: Preventing duplicate requests from resulting in unintended usage or charges.
  • Atomic usage accounting: Maintaining accurate request counts and spending limits, including when multiple requests occur concurrently.
  • Cryptographic security: Implementing signed capabilities and verifiable receipts using Ed25519.
  • Payment lifecycle management: Connecting PayPal authorization, API consumption, and revocation into a coherent workflow.

These challenges pushed us to think beyond simply integrating a payment API and consider the broader infrastructure required for autonomous commerce.

What we learned

Building TollGate gave us practical experience with payment infrastructure, REST API design, authorization workflows, cryptographic signatures, transaction management, and TypeScript SDK development.

More importantly, we explored how traditional payment systems could evolve to support an emerging ecosystem of autonomous AI agents and machine-to-machine interactions.

We learned that enabling autonomous payments requires more than allowing software to initiate transactions. It requires granular permissions, spending controls, reliable accounting, verifiable records, and mechanisms for users to retain control.

What's next

We envision TollGate becoming a payment layer for the agentic internet, where developers can monetize APIs and digital services at the request level, and AI agents can discover, access, and pay for those services programmatically.

Our vision is simple: APIs should be able to charge for what they provide, and AI agents should be able to pay for what they consume.

Share this project:

Updates