In the last quarter alone, I’ve gone through four different RFPs, each from billion dollar companies, asking detailed questions about API traffic costs. Two years ago, the cost question didn’t appear in Commerce RFPs at all. API questions went to IT; procurement wasn’t in the room.

When procurement starts writing the API questions, it means someone has already been surprised by a bill.

If four buyers of that size are screening for this, the exposure is real. The companies not asking have it too.

This isn’t an accident of billing

L.E.K. is currently advising software vendors that seat-based pricing ignores machine consumption entirely, and that per-call and hybrid models are the way to capture it. They point to AWS's million free monthly API calls — a buffer sized for human workloads — as something a single busy agent can exhaust far faster than anyone planned for.

So the repricing isn't drift. It's strategy, and your vendors are being handed the playbook. Their examples are CRM and coding agents rather than storefronts, but the same dynamic is arriving in commerce, and it's arriving alongside a second problem: the volume itself is compounding.

What the bots actually cost you

Cloudflare reported in June that automated traffic crossed the halfway mark against human traffic for the first time, at roughly 58% of HTML requests. Fastly, measuring a different slice of the internet across 6.5 trillion monthly requests, puts bots at about 37% of observed traffic. The methodologies differ; the direction doesn't. And commerce sits at the sharp end of it — e-commerce draws a larger share of unwanted bot traffic than any other industry, and attacks on commerce sites roughly doubled year over year.

The volume is the part that breaks financial models. Fastly's research puts AI crawlers at close to 80% of AI bot traffic, with individual fetcher bots exceeding 39,000 requests per minute — load patterns indistinguishable from a small DDoS.

Here's the arithmetic that matters to you, using round numbers you can swap for your own:

Say you serve 10 million product detail page requests a month. If 40% of that is non-human, that's 4 million requests from traffic that will never convert. If each PDP render fans out to five backend calls — pricing, inventory, promotions, recommendations, cart state — you're at 20 million machine-driven API calls a month. At an illustrative $1 per thousand calls, that's $240,000 a year in software cost attached to zero revenue.

If your commerce vendor charges per API call, you're not paying for growth. You're paying a variable bot tax that scales with crawler volume and has nothing to do with sales.

Run that against your own traffic mix and your own rate card. Whatever number comes back, the question is whether anyone modeled it when the contract was signed.

Why blocking everything backfires

The obvious move is to shut the door. Cloudflare customers blocked over 400 billion AI bot requests in the five months after default crawler blocking went live.

But blanket blocking hides your inventory and pricing from buyers who are actively trying to spend. Adobe's data on AI-referred shoppers shows they view more pages, spend meaningfully more time on site, and convert roughly 30% better than other channels. Salesforce put AI agent influence on global retail holiday sales at around $260 billion — near a fifth of total volume.

The traffic itself is not what's costing you. The cost comes from paying storefront-rendering prices to serve a machine that only needed a price and a stock count. Agents don't need your HTML. They need a structured feed, which is the whole premise behind the Agentic Commerce Protocol and Model Context Protocol, and why the infrastructure conversation is heading that direction.

Three questions to take into your next vendor conversation

These are commercial questions, not architecture decisions. Your CTO owns the how. You own whether the economics work.

1. Does our agreement distinguish machine traffic from customer traffic? Pull your SaaS agreements and look for unmetered API tiers, overage penalties, and seat-based models that assume a human on the other end. Ask your vendor directly what happens to your bill if non-human requests double next year — and get the answer in writing before renewal, not after. Negotiated exclusions for non-revenue bot traffic are achievable, but only if you raise them while you still have leverage.

2. Can we serve agents through a structured feed instead of a full page render — and what does that do to our bill? Ask your CTO whether the platform can expose pricing and inventory through a dedicated feed for agents while keeping training crawlers out. Then take that answer back to your vendor and ask what it changes commercially. If the cost is identical either way, your pricing model isn't tied to the work being done.

3. What are we measuring, now that a growing share of influence never touches our site? If a meaningful portion of buying decisions is happening off-platform, page-view-based reporting is telling you less every quarter. Ask what your team would need to track machine query density alongside traditional funnel metrics, and what that visibility costs.

The point

Traffic growth used to be a proxy for business growth. It isn't anymore, and any contract that still assumes it is has a variable cost sitting inside it that nobody has priced.

---

Full disclosure: I'm CRO at Broadleaf Commerce, where we license flat-rate with no API usage caps — so I have an obvious horse in this race. The three questions above are worth asking regardless of who you buy from, and I'd rather you ask them of your current vendor than not ask them at all.