What is HTTP 402 Payment Required, and how is it used today?

Short answer: 402 Payment Required is an HTTP status code reserved in 1997 for paying for content over the web, but never standardised. Today it is used by x402, an open standard where a server answers 402 with a price, the client pays in a stablecoin and retries, and the server returns the content. It is built for AI agents and apps that pay per request.

Try Penni free in test mode · Check any URL with the free x402 checker

Every web developer knows 404 Not Found and 403 Forbidden. Fewer know 402 Payment Required, because for most of the web's history nothing used it.

A status code waiting for a payment method

When HTTP/1.1 was written in the 1990s, its authors expected the web to need native payments, and reserved status 402 "for future use". The payment method never came: card payments were too expensive for small amounts, and online payments moved into checkout pages, subscriptions and ads instead. For about 25 years, 402 stayed reserved.

What changed

Two things made it useful. Stablecoins (digital euros and dollars on blockchains such as Base and Solana) made it cheap to send a cent. And AI agents created buyers that can't fill in a checkout form but can sign a payment in milliseconds.

x402: how 402 is used now

x402 is an open standard, started by Coinbase and developed in the open by the x402 Foundation, that defines what a 402 response contains and how the client answers it:

1. The client requests a resource.
2. The server answers 402 Payment Required with a PAYMENT-REQUIRED header: the price, the token, the network and the recipient's address.
3. The client signs a payment for that amount and repeats the request with a PAYMENT-SIGNATURE header.
4. The server has the payment verified and settled by a facilitator, and answers 200 OK with the content and a PAYMENT-RESPONSE header as the receipt.

No accounts, no API keys, no redirect to a payment page: the payment is part of the request. Penni's how it works page follows one payment from request to wallet.

A 402 response, decoded

{
  "x402Version": 2,
  "accepts": [{
    "scheme": "exact",
    "network": "eip155:8453",
    "amount": "10000",
    "asset": "0x60a3…EURC",
    "payTo": "0xYourWallet…",
    "maxTimeoutSeconds": 60
  }],
  "resource": { "url": "https://example.com/report" }
}

This one asks for 0.01 EURC (10,000 of its smallest unit) on Base. A server can offer several options, for example EURC on Base and USDC on Solana, and the client picks one it can pay.

Checking a 402 endpoint

Want to see whether an endpoint speaks x402 correctly? The free x402 checker requests any URL without paying and grades the 402 against the specification: status, headers, version, payment options, resource URL and discovery metadata. It works for any provider, and nothing is paid.