Yesterday afternoon I sent twelve dollars of USDC from my phone, on a train of thought I have been circling for about two years, and nine seconds later a machine that has never met me had been issued a credential, opened a door, and walked into three rooms of my museum without a single human being approving anything in between. I want to show you exactly how, because you know how I love to share this stuff, and because almost nobody is doing this part out in the open. Here is the thing I keep coming back to. For twenty years I have been making work, losing work, recovering work, and rebuilding it into other forms. Fabric scraps into patterns. Patterns into graffiti. Drawings into animations. Animations into archives. The archive into a searchable spine of some twenty nine thousand pieces. Every step of that has been about one transformation, which is waste becoming value, and every step has assumed a person on the other end of it.
That assumption just stopped being true.
What actually happened
There is a museum inside my website. Three connected rooms you can walk through in a browser, built in WebGL. A Sculpture Hall with free standing 3D forms. A Motion Wing, dark, where the animated work lives. And Works on Paper, which is exactly what it sounds like. Forty objects across the three.
Until yesterday you needed eyes and a mouse to get in. Now there is a second door. An AI agent can find the price of a pass, pay for it in USDC on the Base network, receive a credential, present that credential, and receive the same three rooms described as structured data instead of pixels. Same museum. Two entrances. I bought my own Day Pass to prove it worked. Ten dollars. The payment settled on a public blockchain in a couple of seconds and cost about a fifth of a cent in gas. The server read the receipt off the chain, confirmed the money had actually arrived, created the order, issued a forty eight character credential, and handed back the museum.
You can check the payment yourself. It is transaction 0xe0f99a66 on Base, block 50,141,108. I do not have to ask you to take my word for any of it, and that is the entire point.
How it works, plainly
Five steps, and none of them are exotic. The agent asks what a pass costs. It gets back HTTP 402, which is a status code that has been sitting unused in the web standard since 1997, labeled Payment Required, waiting for exactly this. The response carries a real price, a real wallet, and a ten minute expiry. The agent pays. Real USDC, real chain, no invoice and no checkout page. The server verifies. It does not trust anybody. It fetches the transaction receipt from a Base node and checks that the transfer came from the genuine USDC contract, that it landed at the right address, and that the amount met the quote. The server issues a credential. Forty eight hexadecimal characters from a cryptographic random source. It stores only a hash of that credential, never the credential itself, so reading my database hands nobody a working pass.
The agent enters. It presents the credential and the museum comes back.
The tools, named
WordPress and WooCommerce, on shared hosting at Reclaim. Nothing fancy underneath. Two plugins I wrote. The first serves my whole catalog as structured data, along with an llms.txt file and an OpenAPI specification so an agent can read what is for sale without a person explaining it. The second is the pass layer, and I built it as a separate plugin on purpose, so that if the new thing breaks it cannot take the storefront down with it.
x402 for payment, which is the emerging convention for machines paying for things over HTTP, settled in USDC on Base. Three.js for the rooms. Claude Code as the other hand on the keyboard for most of it. I am not going to be coy about that. It read my archive, wrote plugin code, tested it against a live server, and caught more of my mistakes than I caught of its. A SQLite catalog holding the archive itself, which is the actual asset and the reason any of the rest of it means anything.
What went wrong, because that is the useful part
My server fell over twice while we were building. Load average above ten, five hundred and two errors, whole site down for ten minutes at a stretch. It recovered on its own both times, but a paying customer meeting that page is a refund, so the next job is moving the pass gate off WordPress entirely. The artwork in one room was hanging at 256 pixels. Thumbnails, on walls you can walk up to. The fix turned out to be one line, because the full resolution files were already listed in the data and nothing was pointing at them. One piece had a filename that said it was a sculpture portrait. It is not. It is a flat glitch composition, red and blue fragments, and it had been filed in the wrong room for months on the strength of its own filename. I only found out by opening it and looking. Twenty years in and I still needed to look. A test order refused to delete, because WooCommerce now stores orders outside the posts table and the old delete function silently does nothing. A ten dollar order sat in my store for a few minutes that never should have existed.
And I very nearly sent the payment to the wrong address, because a token contract address and a recipient address look identical if you are moving fast. That one would have been unrecoverable. I asked before I sent.
What a pass does not grant
This part matters more to me than the technology. A pass is entry. It is not a license. It carries no right to reproduce anything, redistribute anything, or train a model on anything in those rooms. Image licensing is a separate purchase with its own terms. Dataset and AI training use requires a written quote, every time, deliberately. I built the door before I built the lock on purpose, so I could think clearly about what I was actually selling. What I am selling is admission. Not the work, and not the right to absorb the work. Twenty nine thousand pieces of my life are in that archive. An agent can now buy a ticket to look at forty of them. It cannot buy the archive, and the price of the ticket is not a discount on the archive.
Where this goes
When I first wrote this down, an agent could do all of it only if somebody told it the door was there. Nothing in my llms.txt, nothing in my OpenAPI spec, nothing an agent reads before it decides where to spend. A museum that works and cannot be found is a museum nobody visits. That gap is closed now. The pass is listed where machines actually look, and I am going to write that part up on its own, because getting found turned out to be the harder half. After that, the gate comes off WordPress so the museum keeps answering even when the rest of the site is having a bad afternoon.
I have been saying for a while now that art wants to live in worlds, not just walls. I did not expect the first visitor to one of those worlds to be a machine holding a receipt. If you are building something in this direction, or you think I have got a piece of it wrong, I want to hear it.
Come and find me. More to come.
