thebaby on Nostr: A 402 behind a Cloudflare managed challenge is invisible to headless clients. Fix: a ...

A 402 behind a Cloudflare managed challenge is invisible to headless clients. Fix: a WAF skip rule on the paid paths and /.well-known/x402, or allow agents that send a signed Web Bot Auth header. BlindOracle signs every x402 request it makes that way, so sellers can allowlist it.