You run a permit records business. For years your customers were people with a login who searched a few times a week. Then the emails changed. "Can we get a key so our AI helper can pull records?" Now you get that ask every week.
The problem
You issued a few keys. One ended up in a shared settings file at an agency with fifty clients. Another pulled your whole county in one night. A third is still active, and you are not sure who has it now.
You cannot tell which buyer made which call. You cannot switch off one buyer without changing the key for everyone. You cannot charge per lookup, because the key is the thing you sold, not the lookup. And when you refuse to issue a key, someone writes a scraper and takes the data anyway.
The demand is real and you want the revenue. You do not want your key in a thousand config files, your licence ignored, and your price set by whoever copied you last.
The largest data owners have reached the same place. Reddit's chief executive put the rule in one line.
"Commercial use of our data requires commercial terms."
Reddit has a legal team to enforce that line. You have a permit database and a small staff. You need terms that a buyer's AI helper will follow on its own.
Why this keeps happening
A key mixes up two different things. One is permission to use your data under your terms. The other is the technical ability to reach your system. When you hand out a key, you hand out both at once, forever, to whoever ends up holding it.
That is why the usual advice on data licensing ai buyers is so thin. Nobody has separated the two. And when you refuse the key, the scraper comes anyway. Cloudflare's chief executive described what that looks like from the owner's side.
"Instead of being a fair trade, the web is being stripmined by AI crawlers with content creators seeing almost no traffic and therefore almost no value."
As of July 2025, Cloudflare changed its default to block AI crawlers unless they pay the site owner, and added a pay-per-visit option. That protects your web pages. It does nothing about a key you already handed out. Here is what one shared key costs you.
| With one shared key | What it costs you |
|---|---|
| Every buyer looks the same | No usage report, no per-buyer pricing, no proof of who got what |
| A key issued for lookups can also bulk-export | Your whole set walks out in one night |
| Revoking means changing the key for all | Every honest customer breaks on the same day |
| Some AI tools pass the key straight through | You do not even know which tool is calling |
| Refusing keys pushes buyers to scrape | Licence broken, revenue zero, and you cannot see it |
The pass-through row deserves a word. Some tools that sit between an AI helper and your data forward the buyer's key as if it were their own. If you want the technical side, search for mcp token security, or read why a tool should never pass a key through. MCP is a standard way for AI helpers to use tools that live elsewhere, and it is where a lot of this traffic now comes from. Its own rules, in the November 2025 revision, say a tool must not pass through the key it was given. A tool that asks for your key to forward it is breaking the standard, not just annoying you.
How to fix it
- Stop issuing one key per buyer. Give each buyer their own short-lived pass instead. It should name the buyer, what they may read, a spending cap and an end time.
- Limit fields and speed. Answer questions, do not hand over dumps. A pass for lookups should not be able to pull the whole county.
- Count every call and put the buyer's name on it. That count is your invoice and your evidence.
- Put your licence in writing with every reseller. If a software firm wraps your data for their own customers, the contract says what they may resell and to whom.
- Watch for odd patterns. A buyer who normally does forty lookups a day and suddenly does forty thousand is a problem you want to see that morning.
- Price per lookup or per month, not per key. A key is a one-time sale that leaks. A lookup is revenue every time your data is useful.
There are three ways to sell access that follow those rules. You can use more than one. The second row is what people mean by an api marketplace for ai agents: a place where a buyer's helper finds your service, pays, and uses it under your terms.
| Way to sell | Who holds your key | Who sets the price buyers see | Fits when |
|---|---|---|---|
| Through a reseller | A software firm that licensed your data, under a contract that allows resale | The reseller, with your cost inside their price | You want a few contracts, not many relationships |
| Through the marketplace directly | You, behind the marketplace; buyers get passes, not the key | You, as a line on the buyer's bill | You want per-use revenue and your own pricing |
| Requests first, then build | Nobody yet; buyers ask, and the asks are gathered by provider | You, once you decide to list | You want to see demand before doing the work |
Two more cases for completeness. Public data needs no account at all. And some buyers already have a licence with you; they can connect their own account, and their AI helper gets a reference to it, never the password. You keep the direct relationship. This is the same principle as giving an AI helper the least access it needs, applied from the seller's side.
You may hear that you should license at your own front door instead. Block the crawlers, charge per visit, and post your terms on your site in a form a computer can read. Do that too. It protects your web pages. It does not give a buyer's helper a pass that expires, count lookups per buyer, or send you a receipt. The two work together.
What the market pays today, as of September 2026. The directories that list data connectors charge nothing and pay nothing, so a connector to your data listed there earns you licence revenue only if you enforce it yourself. Apify pays 80 percent of pay-per-event revenue to the developer after platform costs, which is the closest existing model to per-lookup data pricing. AWS Marketplace charges a 3 percent listing fee on public software sales. None of these separate the buyer's permission from a key.
What BlueBear's marketplace does about it
On BlueBear's marketplace, a data service is sold as an offer with a public page and a price in credits, where 1 credit is $1. A buyer's AI helper does not get your key. During the pilot, it asks the marketplace for access and gets proof it paid, limited to that request's budget. Traffic comes through the marketplace, so there is no side door that skips the count.
Every lookup gets a receipt: who paid, what ran, which version, what it cost. For data, the receipt can also carry the date each fact was true and where it came from. Your share of each job is written as a line tied to that receipt. You can switch one buyer off without touching anyone else. The buyer keeps the same receipt as proof of which named helper made the call, which is exactly the identity your receipt records.
What is manual or not built. The marketplace is a pilot, and listing is by invitation; BlueBear lists the offer for you. Selling through a reseller works today by the reseller declaring their rights to your data on their offer. The "requests first" path exists as recorded requests when a buyer's need cannot be met, not as a dashboard you browse. Passes that your own system checks directly, and choosing between two data sellers automatically, are future work. Payouts are done by hand.
What to do next
This month, stop issuing new shared keys. Write down which buyers hold the old ones. Put a licence clause in front of every reseller. Then decide which of the three ways to sell fits you.
Is your data the kind an AI helper must look up rather than guess? Then the next question is how to price it, and how to get paid for keeping it current. Read how to get paid for keeping your data fresh. To see how offers are presented today, and how people license data to ai agents through them, start at the BlueBear marketplace.
Questions people actually search for
- how do i license data to ai agents safely
Stop handing out keys and sell access through a middle service instead. Your key stays with you or with one contracted reseller. Each buyer gets a short-lived pass that names their company, the fields they may read, a spending cap and an end time. Every lookup is counted and gets a receipt. You are paid per use and can see usage per buyer. If one buyer misbehaves, you switch off that one pass and nobody else notices.
- can i cut off one buyer without changing my key
Yes, when access runs through per-buyer passes instead of a shared key. Each buyer holds their own pass with its own end time. Revoking one, or letting it expire, affects only that buyer and leaves your key untouched. With a shared key, the only fix is to change the key, which forces every honest customer to update on the same day. Per-buyer passes plus rate limits and field limits give you far finer control.
- what is an api marketplace for ai agents
It is a place where AI helpers can find a data or tool service, read what it costs and what it needs, pay for it, and use it, without a person setting up an account first. For a data owner, the useful ones add three things a plain directory lacks: per-buyer access you can switch off, counting of every use, and a receipt for each job. During BlueBear's pilot, buyers' helpers can attach to the marketplace and do those steps within a spending limit.
- who is calling my data service when agents use it
With a shared key, you cannot tell. Ten agencies and their fifty clients all look like one caller. With per-buyer passes, every lookup carries the buyer's company, the version they used and what it cost, and that goes onto a receipt you can read. You can see calls per buyer, per month, and prove which buyer received which records if a licence dispute ever comes up.