Point an agent at a task involving money and watch what it does with an API: it doesn't read the documentation the way a developer would, it probes the endpoint, retries with variations when a call fails, and chains it to two other services to get the job done. Stripe built its Agent Toolkit specifically for this caller, giving an agent scoped, revocable permissions to make payments or manage subscriptions on a company's behalf rather than the full account access a human developer's API key implies.
The deeper infrastructure problem is discovery: an agent needs a machine-readable way to find out what an API can do and how to call it correctly, without a human writing that logic in advance. Anthropic's Model Context Protocol, released in November 2024 and adopted by OpenAI within a year, standardizes exactly that — a common way for a model to discover tools and data sources at runtime instead of every integration being bespoke, hand-wired code.
Rate limiting, pricing, and abuse detection were all built around a human deciding when to make a call. An agent that fires off hundreds of exploratory requests while completing one task breaks pricing models built around occasional human usage and strains fraud systems tuned to catch malicious humans, not busy but legitimate machines. Publishers hit the same wall from the content side: AI crawlers scraping a site far more aggressively than a human reader ever would, without paying for it or asking.
Cloudflare's answer, a pay-per-crawl marketplace it opened in 2025, lets a publisher charge an AI crawler per request instead of choosing only between blocking it outright or giving access away free. It is the API economy's version of a toll booth built specifically for machine traffic, arriving because the traffic got large and valuable enough to be worth pricing rather than just tolerating or banning.
Providers moving fastest are treating agent traffic as a distinct customer segment with its own product requirements: documentation written for a model instead of a person, service-level agreements that assume retry storms, authentication built for delegated permission rather than a single human's login. That reframing, more than any single protocol, will likely decide who ends up owning the interface layer agents actually rely on.
The web already lived through one version of this when search crawlers became a bigger audience for many sites than human visitors ever were. Agents calling APIs are the sequel, except this time the traffic can also pay, act, and negotiate — and the companies building toll booths and permission layers now are the ones betting they can charge for that instead of just absorbing it.