What it is
HTTP 402 is one of the standard three-digit status codes a web server can send back when it refuses a request — in the same family as the familiar 404 (Not Found) or 403 (Forbidden). Its official text is “Payment Required.” It first appeared in RFC 2068 (1997), one of the early specifications of the HTTP protocol, and every revision since — through RFC 2616 (1999) up to the current RFC 9110 — has kept the same one-line definition: the code is “reserved for future use.” No HTTP specification has ever said what a 402 response should look like, what headers it should carry, or how a client should respond to one. It has been, in effect, a blank line left in the web’s rulebook for three decades, on the assumption that someone would eventually build a native way for servers to say “pay me before you get this.”
That gap stayed empty mainly because the web built payment systems elsewhere — credit-card checkout pages, subscription logins, API keys issued after a signup form — none of which needed a dedicated status code. A human filling out a payment form doesn’t need the server to interrupt the HTTP exchange itself; the browser just shows a page. The code remained a curiosity cited in blog posts about HTTP trivia.
That changed because the clients making web requests are no longer only humans with browsers and credit cards. Starting in 2025, companies building infrastructure for autonomous AI agents began using 402 for exactly the purpose its drafters once imagined: a machine-readable way for a server to tell a non-human requester, mid-request, what it costs to proceed. Coinbase published a protocol called x402 in May 2025 that fills in the specification the IETF never wrote — defining HTTP headers that carry a payment “challenge” from the server and a cryptographic proof of payment (typically in the stablecoin USDC) from the client — and shipped a V2 upgrade in December 2025 adding wallet-based identity and support for more blockchains and payment rails. Cloudflare, an x402 Foundation co-founder alongside Coinbase, built the protocol into its Agents SDK and opened a closed beta of a “Monetization Gateway” in 2026, letting any site owner charge AI agents per API call, per crawl, or per dataset query using 402 responses settled in stablecoins. A parallel, non-crypto protocol called the Machine Payments Protocol (MPP), backed by Stripe and Tempo, adds similar machine-readable payment headers that can settle in credit cards as well as stablecoins.
Why it matters for AI governance and narratives
HTTP 402’s revival is a quiet but consequential move in the economics of the agentic web: it is one of the first standardized mechanisms for charging an AI agent, rather than the human or company operating it, directly for consumption — autonomously, without a checkout page or a human approving each transaction. That raises exactly the governance question The New Stack put to Cloudflare’s beta: who actually controls an agent’s spending, and what happens when an agent authorized to act on someone’s behalf starts accumulating charges faster than any human oversight loop can catch? The code also reframes a long-running narrative fight over AI and content: publishers who have spent two years arguing that AI crawlers should pay for the content they scrape now have, for the first time, an actual billing mechanism to point to rather than a demand with no implementation path. Cloudflare’s own publisher-compensation beta runs on the same rail. Whether 402-based micropayments become the AI industry’s version of a toll system, a niche feature for a handful of API providers, or a flashpoint for a fight over machine-to-machine financial accountability is still unresolved — the beta programs are recent, small, and crypto-dependent enough that broader adoption is not yet established.
Key facts and dates
- 1997: HTTP 402 “Payment Required” first defined (as reserved) in RFC 2068.
- June 1999 / June 2022: Code persists unchanged as “reserved for future use” through RFC 2616 and the current governing spec, RFC 9110 (IETF).
- May 6, 2025: Coinbase publishes the x402 whitepaper, the first serious specification of how 402 responses and payment headers should actually work, using stablecoins (chiefly USDC) on networks including Base and Solana.
- December 11, 2025: x402 V2 ships, adding wallet-based identity and multi-chain/multi-rail support; Coinbase reports roughly 75 million transactions worth about $24 million processed through x402 by that point.
- 2026: Cloudflare, a founding member of the x402 Foundation alongside Coinbase, opens a closed beta for its Monetization Gateway, letting site owners charge AI agents per use for APIs, MCP tools, and datasets over HTTP 402; named early customers include Cloudflare’s own AI Gateway, Ceramic.ai, Stocktwits, and API2PDF. A parallel Stripe/Tempo-backed protocol, the Machine Payments Protocol (MPP), extends similar machine-readable payment headers to card-based settlement.
Where to learn more
- RFC 9110 — HTTP Semantics, §15.5 (IETF) — the current authoritative specification confirming 402’s “reserved for future use” status.
- Cloudflare Developers — Agentic Payments — Cloudflare’s own documentation of how its Agents SDK and Monetization Gateway implement 402-based payments via x402 and MPP.
- x402: An Open Standard for Internet-Native Payments (whitepaper, x402.org) — the primary specification document for the protocol that gives HTTP 402 its machine-readable payment mechanics.
- Coinbase Developer Platform — Introducing x402 — Coinbase’s own launch announcement and rationale for the protocol.