The status code that waited thirty years

There is a line in the HTTP specification that has been an open TODO for almost thirty years. Status code 402, Payment Required, appears in the earliest HTTP/1.1 drafts alongside 401 Unauthorized and 403 Forbidden, but where those two got precise semantics, 402 got a sentence: reserved for future use. Successive revisions of the spec kept it and kept the sentence. Generations of engineers have read past it the way you read past a commented-out function nobody wants to be the one to delete.

The intent was never mysterious. The people writing the web expected it to grow a native payment layer, and 402 was the hook they left for it. The W3C even ran a micropayments group in the late nineties. It produced specifications, and then it produced nothing, because the economics underneath were impossible. A card transaction carries a fixed cost measured in tens of cents plus a percentage. Charging for a single HTTP request that costs a fraction of a cent to serve means the fee is several hundred times the price of the good. On top of that sits chargeback risk, a settlement window measured in days, and a merchant relationship that requires a legal entity on both ends.

So the web routed around it. Instead of paying per request, we invented the subscription, the API key, the prepaid credit balance, and the free tier that exists to collect an email address. All four are compensating mechanisms for a payment primitive that was specified and never built. All four require an account, which requires an identity, which is where geography, KYC and every other gate quietly attaches itself.

Three things had to land at once, and in the last two years they did. First, a dollar-denominated bearer asset whose transfer cost is small enough that a sub-cent payment is not absurd. Second, a way to authorize that transfer without the payer holding gas or waiting for a block: EIP-3009 transferWithAuthorization lets a wallet sign a transfer off-chain and hand the signature to someone else to submit. Third, and least discussed, a class of buyer that has no card at all. An autonomous agent cannot open a billing account. It can hold a key and sign.

The x402 standard, contributed by Coinbase and now stewarded under the Linux Foundation, puts payment inside the ordinary request cycle rather than beside it. There is no session, no checkout page and no callback URL. The whole exchange is:

• The client requests a paid resource with nothing attached.
• The server answers 402 with machine-readable terms: price, asset, network, payee.
• The client signs an EIP-3009 authorization and repeats the request with the signed payment header.
• A facilitator verifies the payload off-chain in a single round trip.
• The facilitator settles onchain, returns a transaction hash, and the response streams.

Read that list and notice what is missing. There is no registration step, no key issuance, no balance to top up, and no state on the server that survives the request. The buyer is identified by a signature over the exact amount they agreed to pay, and nothing else about them is asked for or learned.

HTTP/1.1 402 Payment Required
Content-Type: application/json

{
  "accepts": [{
    "scheme": "exact",
    "network": "robinhood-chain",
    "asset": "USDG",
    "maxAmountRequired": "0.0182",
    "resource": "/v1/chat/completions",
    "description": "1 completion, claude-sonnet-5",
    "payTo": "0x…",
    "maxTimeoutSeconds": 60
  }]
}

The x402 Foundation went operationally live on 14 July 2026 with forty member organizations, a list that includes Visa, Mastercard, American Express, Stripe, Google, AWS, Shopify, Cloudflare and Coinbase. Coinbase reported roughly 165 million settled x402 transactions and about $50 million in cumulative volume by late April 2026. Those are not enormous numbers by payments standards. They are enormous numbers for a status code that had no implementations at all eighteen months earlier.

A payment standard that requires an account is a membership scheme. One that requires only a signature is a price.

We would be selling you something if we pretended this is finished. The header naming is genuinely unsettled — the community specification and the current vendor documentation disagree, which is why our own docs talk about the signed payment header and EIP-3009 rather than pinning a name you would then have to change. Every payer needs a wallet, which is a real adoption cost for humans even though it is nearly free for agents. And the regulatory treatment of per-request stablecoin settlement is not uniform across jurisdictions.

None of that changes the shape of the thing. Wuraw returns 402 on paid routes because 402 is what the situation is. The response is not an error and we do not treat it as one. It is a quote, and the client is free to decline it.