HTTP history · updated 2026-07-18

402 Payment Required: the HTTP status code that waited 30 years

HTTP 402 Payment Required is the status code a server returns when access to a resource requires payment. It has been in the HTTP specification since January 1997 — where it was marked "reserved for future use" — and it stayed essentially dormant for nearly three decades. The future it was reserved for arrived in 2025, when AI agents needed a way to pay for things and the x402 protocol finally gave the code standard semantics.

First-hand source: ForgeMesh Labs serves live 402 responses in production on 500+ paid endpoints across 11 services and counting. This history is written by people who ship the status code daily.

402 vs 401 vs 403: what's the difference?

Status code	What it means	How a client resolves it
401 Unauthorized	You have not proven who you are	Authenticate — send valid credentials
402 Payment Required	Access requires payment	Pay — with x402, retry the request with an X-PAYMENT proof header
403 Forbidden	You are known, but not allowed	Nothing — access is denied regardless of credentials or payment

The key distinction: 401 asks who are you, 403 says no matter who you are, and 402 asks for exactly one thing that software can supply without a human in the loop — money.

The full history of HTTP 402

Era	What happened	Detail
1989–1991	The web launches without a payment layer	Tim Berners-Lee's World Wide Web ships with ways to request, link, and render documents — but no native way to charge for them. Payment is acknowledged early as a gap for the future.
1994–1998	First-wave micropayments rise and collapse	DigiCash's eCash (founded by cryptographer David Chaum), First Virtual, CyberCash, and DEC's Millicent all attempt sub-dollar web payments. DigiCash files for bankruptcy in 1998; the others fade. Card fees, no wallet standard, and too much user friction kill the category.
January 1997	HTTP/1.1 reserves 402 Payment Required	RFC 2068 defines status code 402 with a single sentence: "This code is reserved for future use." RFC 2616 (1999) keeps it. The web's payment slot exists — with nothing standardized to fill it.
Late 1990s–2000s	W3C micropayment efforts close; ads win	The W3C's micropayment markup work is wound down. Advertising and subscriptions become the web's business models. 402 appears only in one-off APIs as a quirky "you owe us money" signal.
June 2022	RFC 9110 keeps 402 reserved — 25 years on	The modern HTTP semantics standard still describes 402 as "reserved for future use," making it the longest-running placeholder in the protocol's history.
May 2025	Coinbase activates 402 with the x402 protocol	x402 gives the status code its missing payload: a standardized, machine-readable payment challenge answered with a cryptographic payment proof. Stablecoins provide what 1990s micropayments never had — instant, sub-cent, programmatic settlement.
July 14, 2026	Linux Foundation launches the x402 Foundation	40 members including Visa, Mastercard, American Express, Stripe, Google, AWS, Cloudflare, and Coinbase commit to standardizing 402-based payments under neutral governance.
September 15, 2026	The web starts charging bots by default	Cloudflare's new defaults block AI training and agent crawlers on ad-supported sites, with paid access via x402 as the sanctioned alternative. The status code reserved in 1997 becomes infrastructure.

Why did web micropayments fail the first time?

Every 1990s micropayment company hit the same three walls:

1. Transaction fees ate the transaction

Card networks charge roughly $0.30 plus a percentage per transaction. You cannot sell a $0.001 dictionary lookup when the fee is 300× the price. Until stablecoin rails, no settlement layer could economically move a fraction of a cent.

2. No standard, so no network effect

eCash, CyberCash, First Virtual, and Millicent each required their own wallet, their own merchant integration, and their own trust model. Every seller integration only worked for one buyer population. HTTP had reserved 402 precisely so a standard could exist — but none of the contenders became it.

3. Humans hate paying per click

Decades of research on "mental transaction costs" showed people would rather pay $10/month than think about $0.01 forty times a day. The economics only invert when the buyer is software: an AI agent evaluates a price against a budget in microseconds and feels no friction.

That third wall is the one everyone underestimated. 402 didn't fail because the idea was wrong — it failed because the web's only buyers were human. The moment autonomous software became a buying population, the 30-year-old placeholder became the most natural interface on the internet: the request already is the order; 402 just attaches the invoice.

Why 402 matters in 2026

AI agents can't fill out checkout forms. They can read a 402 challenge and sign a payment in milliseconds. The x402 protocolmade that exchange a standard, and the Linux Foundation's x402 Foundation — 40 members including Visa, Mastercard, Stripe, Google, AWS, Cloudflare, and Coinbase — now governs it.
The free-crawling era is ending. On September 15, 2026, Cloudflare's new defaults begin blocking AI training and agent crawlers on ad-supported sites. Its Monetization Gateway gives those same crawlers a paid path in — over 402.
The economics finally work. Stablecoin settlement moves $0.001 for less than $0.001. In our own fleet, live endpoints price from a tenth of a cent and settle atomically — a paid call either delivers the resource or the buyer isn't charged.

What is x402? Full protocol guide Put a 402 in front of your own URL

402 Payment Required: frequently asked questions

What does 402 Payment Required mean?

HTTP status code 402 means the server requires payment before it will serve the requested resource. Historically it was reserved and rarely implemented. Today, services using the x402 protocol return a 402 response containing machine-readable payment instructions — price, currency, network, and receiving address — that a client can fulfill automatically.

Why do I see error 402 on a website or API?

The operator is telling you the resource is paid. On legacy platforms 402 sometimes signaled a billing problem (an expired card or exhausted quota). On modern x402-enabled services it is not an error at all: it is a price quote. Pay the stated amount and retry the request with proof of payment to receive the resource.

Is HTTP 402 an official status code?

Yes. 402 Payment Required has been part of the HTTP standard since RFC 2068 in January 1997 and remains in RFC 9110 (2022), where it is described as "reserved for future use." It is official but was never given standard semantics — which is exactly the gap the x402 protocol fills.

Why did 402 go unused for almost 30 years?

Because no payment rail fit it. Card networks impose per-transaction fees around $0.30, making sub-cent charges impossible; 1990s digital cash companies like DigiCash went bankrupt before standardizing anything; and human users preferred subscriptions over per-click payments. Programmatic buyers (AI agents) plus instant stablecoin settlement removed all three blockers at once.

What is the difference between 402 and x402?

402 is the HTTP status code — a number in a response. x402 is the open protocol (now governed by the x402 Foundation under the Linux Foundation) that defines what a 402 response should contain and how a client should pay it: the challenge format, payment schemes, proof headers, and settlement flow.

Who uses 402 Payment Required today?

Thousands of services. ForgeMesh's crawler counts more than 1,130 unique sellers with roughly 25,000 live paid resources in the x402 discovery catalog as of July 18, 2026. Cloudflare's Monetization Gateway lets any site behind Cloudflare answer with 402, and AWS and Google are among the 40 members of the x402 Foundation.