Cloudflare now lets AI agents buy domains and deploy to production

Cloudflare said on April 30, 2026 that AI agents can now create Cloudflare accounts, start paid subscriptions, register domains, receive API tokens and deploy code directly. The flow is built on a new protocol Cloudflare co-designed with Stripe as part of Stripe Projects.

The source is Cloudflare’s own post, “Agents can now create Cloudflare accounts, buy domains, and deploy.” Cloudflare says humans still accept terms and can stay in the approval loop, but the agent no longer needs a human to open dashboards, copy API keys or enter card details. Stripe provides the identity and payment layer. Cloudflare provisions the account, resources and credentials back into the agent workflow.

The practical shift is bigger than Cloudflare. Agents are moving from writing code to buying and configuring infrastructure. A coding agent can receive a task, choose a provider, register a domain, obtain access and put an application into production. That removes friction, but it also creates a new risk class.

Cloudflare describes three core mechanisms: discovery, authorization and payment. The agent discovers services through a catalog, gets authorization through the user’s existing platform identity, and receives a payment token with limits. Raw card details are not shared with the agent, and Cloudflare points to a default Stripe Projects limit of 100 dollars per month per provider.

For CIOs and CISOs, the signal is clear. Agent governance has to cover procurement, account creation, spending limits, API keys and production deployment, not only data access inside Microsoft 365 or GitHub. If developers get agents that can provision cloud resources, the business needs policy for who the agent represents, what budget it can spend, what domains it can buy and how every action is logged.

Assessment: this is useful and dangerous at the same time. It is exactly how agent infrastructure needs to work to become productive. It is also exactly how shadow IT gets a turbocharger if governance is not in place before rollout.