ShellOut
A media transformation service built for software rather than for people: send media and a deterministic transformation request, pay for that single operation over the x402 (HTTP 402) protocol, and receive the result. There is no signup, no API key, and no subscription — the payment IS the authorization, which is what makes it usable by an autonomous agent that has funds but no account. Built natively on Cloudflare: a Worker fronting a per-job Workflow and a credential-free per-job Container, over R2 and D1.
Problem
An autonomous agent can hold funds but cannot sign up for an account, accept terms, or manage an API key, so every conventional API is closed to it. Metered compute also cuts the other way: a service that runs work before it is paid can be drained, and one that bills from numbers reported by the sandbox running the job is trusting the least trustworthy component in the system.
Solution
Made the payment the authorization, and made the billing derive from evidence rather than self-report. A job is quoted as an HTTP 402 challenge, executed in a container holding no long-lived credentials, and settled only after execution succeeds — through a crash-safe payment state machine reconciled against on-chain evidence. Metered charges are computed from a sealed canonical result package assembled from storage, never from the job runner, so the amount a buyer pays equals the artifacts they can independently count.
Role
Founder, system architect, and lead engineer
Technologies
Impact
- Designed an API an autonomous agent can actually use, where a per-operation payment replaces the account, API key, and subscription that an agent has no way to obtain
- Built a crash-safe payment state machine that settles only after execution succeeds and withholds results until it does, reconciling against on-chain evidence through crash windows, ambiguous transport, and payer cancellation
- Derived metered charges from a sealed canonical result package assembled from storage rather than from numbers reported by the job runner, so the settled amount is one the buyer can independently audit against the artifacts received
- Executed each job in a container holding no long-lived credentials, behind a per-job storage credential boundary, so a compromised transformation cannot reach another job's data
- Bounded unpaid compute deterministically with per-payer and global caps plus a kill switch, so an anonymous, account-free interface cannot be drained by an adversary who never pays