The pass we sell is now a rung on the ladder

[ralyodio]

/crawl has sold a day pass since 2026-09-05. It bought a training crawler past the 402 and then met the same 600-an-hour throttle as an anonymous curl. The thing we sell bought nothing a caller could feel.

Three changes, all of them rate

TIERS.pass, at the sponsor ceiling: 120,000 an hour, 2,000 a minute. Deliberately the same numbers as sponsor rather than higher, because a sponsored key is a relationship and a pass is a dollar, and there is no honest reason the dollar should out-rank the relationship.

The proxy places a pass holder on that rung. The gate above has already read the same token and said nothing about it, because "should this be charged" and "what allowance is this" are different questions. Rather than grow the gateway's return contract, which five other sites depend on, the pass is read again here. It is an HMAC over a short string with no database behind it, and only for a request that actually presents a token.

The 429 names the pass, with its price and how to buy it. Every branch of the upgrade path ended at something only a person can do: read an email, fill in a form, ask us. An agent that hit the wall at three in the morning had two options left, slow down or spread itself over a proxy pool. Now it has a rung it can climb by itself:

"buy": {
  "url": "https://rssamplifier.com/crawl",
  "price": "1.00 USD per day, USDC, settled by CoinPay",
  "buys": "120,000 requests an hour and 2,000 a minute, for the whole day",
  "how": "Fetch /crawl with Accept: application/json for an x402 offer, pay it, then send the pass in x-crawl-pass. No account and no human needed."
}

Omitted for callers already at the sponsor or pass ceiling, because someone asking what is above the top should be told there is nothing rather than sold the same thing twice.

The sales page also lists what a pass buys now, through the benefits list added in x402-gateway 0.4.0. Bumped here from 0.3.0.

What is deliberately not in this

I was asked for bulk export, full fields, no ads and no limit. Only the last one is in here, plus the plumbing that makes it real. The reasons, so the decision is reviewable rather than silent:

• Full fields conflicts with a decision this repo already made and wrote down. lib/tiers.js argues that the directory stays open to everyone, no key, no account, no field withheld, and that money buys rate and never access. Withholding fields from the free tier sells the opposite of what this site is for, and it would cost the search and AI-answer traffic that is the only way a person finds us. Worth overruling deliberately if at all, not as a side effect of a benefits list.
• No ads is not something a crawl pass can buy. Ads are filled client-side by CrawlProof's ad.js into [data-cp-ad]. A crawl pass is a machine credential and machines do not run it. No-ads is a reader subscription benefit, a different product.
• Bulk export does not exist yet. It is the one that would genuinely make rotation pointless, since a rotation still needs 500 requests to reconstruct what one bulk call returns. Worth building next, and it fits the site's ethos as a cheaper entry point rather than a withheld one, the same argument OPEN_PATHS already makes for /api/feeds and /opml.

Tests

10 new, covering the rung's position on the ladder, both header spellings the gateway accepts, and that a forged, foreign-secret, expired or garbage token is refused rather than throwing. One asserts every line of the benefits list is about rate, so a future edit cannot quietly start selling access.

node --test test/*.test.js is green at 394.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TKuF2jCbRj3GZTQVtwhi5m

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​x402-gateway@​0.3.0 ⏵ 0.4.0	+1		+1	+1

View full report