New middleware lets APIs charge AI bots per request instead of just blocking them

·1 views

AI crawlers like GPTBot, ClaudeBot, and PerplexityBot now account for a measurable share of API traffic for many SaaS platforms, generating real infrastructure costs with no ad, subscription, or conversion revenue in return. Two emerging standards — Web Bot Auth (RFC 9421) and HTTP 402 with x402 — now allow servers to cryptographically verify bot identities and issue machine-readable payment demands that AI agents can settle automatically. A developer has released an open-source Node.js middleware called Wayleave that implements both standards, enabling API owners to charge verified bots per call, rate-limit unverified ones, and serve human users without any interruption. The tool is available now on npm under an MIT license with zero dependencies, while a companion hosted billing and metering service is still in the concept stage pending developer interest. The project's author is gauging demand via a waitlist at wayleave.dev before deciding whether to build the ledger and reconciliation layer.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

A Lean Customer Success Playbook Built for Solo SaaS Founders

A former customer success manager at a 200-person SaaS company has shared a simplified retention framework tailored for solo founders managing between 30 and 150 customers. The system replaces enterprise tools like Gainsight with a five-signal health score that can be reviewed in under 15 minutes per week, covering feature activation, usage breadth, support sentiment, champion engagement, and billing health. Accounts are categorized into healthy, at-risk, or critical bands, each triggering specific outreach actions within defined timeframes. The playbook also outlines a structured rescue sequence for critical accounts, escalating from personalized emails to Loom videos and phone calls over 14 days. The author reports testing the approach across seven solo-founded SaaS products, noting that customers who adopted a second key feature within 45 days retained at more than twice the rate of those who did not.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Integration Tests Exposed 3 Unfixed Bugs That 90% Unit Test Coverage Missed

A developer building an MCP failure library — a shared memory tool that lets AI agents warn each other about recurring errors — discovered that three previously "fixed" bugs were still present after writing a real end-to-end integration test. Despite achieving over 90% unit test coverage across the SQLite layer, MCP transport, and retry logic, production failures occurred almost every other day due to untested component interactions. The integration harness spun up the actual server, used the real STDIO transport and SQLite database, and ran full scenarios without mocks, revealing issues including a cache queried before it finished loading, JSON-RPC payloads being split mid-stream, and a flawed deduplication query that returned random results after 150 database entries. None of these bugs were detectable in isolation because unit tests confirmed individual functions worked correctly but could not verify system-wide behavior. The developer also noted practical pitfalls such as accidentally locking the live database during testing, recommending the use of temporary files, process timeouts, and proper cleanup routines.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

useUpdateEffect Hook Lets React Developers Skip Redundant Mount-Time Effect Runs

React's built-in useEffect hook fires both on component mount and on subsequent updates, which can cause unintended side effects like premature toasts or analytics events. The useUpdateEffect hook from @reactuses/core solves this by wrapping useEffect and skipping the very first invocation, while keeping an identical API signature and cleanup semantics. Under the hood, it relies on a useFirstMountState primitive that flips a ref during render to track whether the component is mounting for the first time. Developers can drop it in as a direct replacement wherever mount-time execution is unwanted, with no new patterns to learn. One notable caveat is that in React 18 StrictMode during development, the callback can still fire on mount due to React's deliberate double-invocation behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Telegram Proxies Use Obfuscation and Fake TLS to Evade State Censorship

Deep Packet Inspection (DPI) systems used by countries like Russia and Iran block Telegram by detecting the distinctive byte signatures of its MTProto transport protocol. To counter this, MTProto proxies employ three layered techniques: XOR obfuscation, random padding, and FakeTLS. XOR obfuscation replaces recognisable magic bytes with random data, while random padding alters packet sizes to prevent statistical fingerprinting by DPI systems. FakeTLS goes furthest by wrapping the entire proxy connection in a legitimate-looking TLS handshake, complete with a real server certificate and standard cipher suites, making the traffic indistinguishable from normal HTTPS browsing. Together, these layers ensure that state-level filters see only encrypted TLS records rather than any Telegram-specific patterns.

0 comments Read more at DEV Community