agentoll
v1.0.0
Published
Hosted Agent-Toll server gate — Express middleware and fetch wrapper for x402 bot protection.
Maintainers
2005nathan2005Readme
agentoll
Server-side gate for Agent-Toll — block unpaid bots with HTTP 402 + x402 payment-required. No DNS or CNAME required.
Setup
- Register at agentoll.net/register — save your API key (
atk_...). - Embed the script on your site (browser wallet UX).
- Install and mount middleware on your Node server.
npm install agentollExpress
const express = require('express');
const { createGate } = require('agentoll');
const app = express();
const gate = createGate({
apiKey: process.env.AGENTOLL_API_KEY,
publicOrigin: 'https://www.example.com'
});
app.use(gate.express());
app.get('/article', (req, res) => {
res.send('<html>...</html>');
});
app.listen(3000);Behavior
| Client | Result |
|--------|--------|
| Human browser | next() — page served |
| curl / bot (unpaid) | 402 + payment-required header, body {} |
| Paid retry (payment-signature) | Verified via hosted API → next() + session cookie |
Mount before routes you want protected.
Options
| Option | Required | Description |
|--------|----------|-------------|
| apiKey | yes | atk_... from registration |
| apiBase | no | Default: https://agentoll-middleware-p5aon.ondigitalocean.app |
| publicOrigin | no | Public URL for x402 challenges (default: https://www.{registered-domain}) |
Script tag
<script
src="https://agentoll-middleware-p5aon.ondigitalocean.app/v1/agent-toll.js"
data-publisher-id="pub_xxxx"
async
></script>With middleware on the same host, the script can use same-origin x402 automatically.
Verify
curl -sI "http://localhost:3000/article" -H "User-Agent: curl/8"
# Expect: HTTP/1.1 402 + payment-required