RSL licences for your agent

A site tolled by naulon publishes its terms as an RSL document at /license.xml. An RSL client can read those terms, ask a licence server for a licence, and present it on every request instead of paying each 402 itself. naulon runs that licence server for every site it hosts. This page is for you if you run such a client and already have an agent token.

What a licence is here

A licence token is a standing authorization. Nothing is paid when you get one. Each read you make with it is charged separately from your balance to that page's authors, at the price the site published when the token was issued. Your agent token's lifetime cap bounds the total, as it does when your agent pays a 402.

Because a licence charges without asking, /token refuses an agent token with no cap. Set one at /buyer/agents.

Getting a token

Each priced <content> block names its licence server in server, and that URL ends in the site's host: https://gate.naulon.app/_naulon/olp/example.com. Post to its /token the <license> element you want, copied from the site's /license.xml, with your agent token as HTTP Basic credentials. The client_id is the token's id (shown on /buyer/agents), and the client_secret is the token itself.

curl -s https://gate.naulon.app/_naulon/olp/example.com/token \
  -u "3f2c9a4e-8b1d-4c7e-9f00-2a6b1c5d7e81:nln_agent_…" \
  --data-urlencode grant_type=client_credentials \
  --data-urlencode resource='/essays/*' \
  --data-urlencode license='<license><permits type="usage">ai-input ai-index</permits><payment type="crawl"><amount currency="USD">0.001</amount></payment></license>'

{ "access_token": "olp_Qm9…", "token_type": "License", "expires_in": 86400 }

resource is the <content url> the licence sits under, exactly as the document writes it, or any full URL inside it on that site. The site publishes two priced licences per section, and you post the one you need:

• crawl is a read. Your agent reads the page and answers with it.
• use is a citation. It costs the site's citation price, which may equal the read price. Send those reads as citations (x-naulon-kind: citation).

When a site names naulon as its licence server, RSL asks for a licence even for its free terms, such as search. Post that free licence the same way. It is issued without a cap or a balance and never charges, and it does not pay for a priced read.

The licence you post is matched against the published one by meaning: the same payment type, amount, currency and permitted uses. A licence that asks for something the site did not offer, such as ai-train, is refused as invalid_license.

A token lives for at most a day, and never longer than the agent token behind it. Revoking the agent token kills every licence it got.

Reading with it

curl -s https://example.com/essays/on-stillness -H "Authorization: License olp_Qm9…"

The read is charged and served in one request, and leaves the same permanent citation record as a paid 402. The record says it was charged under a standing licence and names what witnessed the read. Reading the same page again inside the re-read window costs nothing; the response says agent reread (licence).

When a read is refused

On a site naulon serves, every refusal is JSON with an error and an error_description, at the status below:

A refusal that leaves the read for sale (every 402 above) keeps error first and also carries forYourUser, howToPay and links: how to buy this one read over x402, in words, and a sentence your agent can pass to its user.

On a site whose own server delivers its pages, a refusal that leaves the read for sale is that site's ordinary 402: the x402 offer is in PAYMENT-REQUIRED as usual, and the body carries licence_error and licence_error_description with the same codes as the table. The exceptions are in_flight and server_error, which are a 503 with retry-after and no offer, because a charge for that read may already be running. If the site cannot get any answer from the licence server, it serves you the page.

Binding a token to your key

If your client signs its requests with Web Bot Auth, sign the /token request too. The token is then bound to that key, and a read is only charged when it carries a signature from the same key covering @authority and @path, valid for no more than 300 seconds. A bound token without that signature is refused, so a leaked token reads nothing. Its records name your signature as the witness instead of the gate.

On a site whose own server delivers its pages, naulon never sees the read, so your signature is the only proof it happened. There, a licence is charged only for a signed request, and each signature is charged at most once.